Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe
-
Size
765KB
-
MD5
aa635127a848c96c8d036c3cff8af273
-
SHA1
44a40f79bd81f73a57ae409b7ba125ccb80dc2ef
-
SHA256
2b0ea09a559f1ed1d034c83caa4d368fe207cdf8997347e05f34d458d51b3f95
-
SHA512
22da4b56366a4fc7139de7418ab6fe8b40d3b29655adf20e995e6aacfa83f44b49aa27de9185652754907f1accbe99672df90a5861eddfe32b461b1803966ce3
-
SSDEEP
12288:ZU5rCOTeiDIeWjzXQn5x2Nk3ZF5rn5rLOa54U5w5A:ZUQOJDIeO0n5xX3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1772 3335.tmp 4860 33C2.tmp 2980 3420.tmp 2168 34BC.tmp 3724 351A.tmp 1520 3577.tmp 3272 35E5.tmp 4656 3652.tmp 832 36B0.tmp 3024 372D.tmp 1288 37AA.tmp 3908 3808.tmp 1532 3875.tmp 3812 38D3.tmp 1152 3950.tmp 3372 39BD.tmp 1348 3A0B.tmp 4068 3A69.tmp 1528 3AE6.tmp 2784 3B44.tmp 4668 3BB1.tmp 836 3C0F.tmp 3744 3C9B.tmp 4292 3CEA.tmp 1988 3D67.tmp 3180 3DB5.tmp 2764 3E22.tmp 3572 3E80.tmp 2132 3EED.tmp 2484 3F5B.tmp 4836 3FD8.tmp 2156 4055.tmp 3320 40D2.tmp 4980 4120.tmp 1216 417D.tmp 4420 41DB.tmp 4472 4229.tmp 1232 4277.tmp 4900 42C6.tmp 2220 4314.tmp 5056 4362.tmp 2980 43C0.tmp 3968 441D.tmp 208 447B.tmp 1760 44C9.tmp 1848 4517.tmp 4004 4575.tmp 4120 45C3.tmp 1188 4621.tmp 540 467F.tmp 3272 46DC.tmp 452 472B.tmp 2148 4788.tmp 552 47D6.tmp 4660 4834.tmp 1040 4892.tmp 2520 48E0.tmp 3908 493E.tmp 2248 498C.tmp 1408 49DA.tmp 2072 4A38.tmp 2772 4A96.tmp 1660 4AF3.tmp 3916 4B41.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1772 1232 2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe 88 PID 1232 wrote to memory of 1772 1232 2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe 88 PID 1232 wrote to memory of 1772 1232 2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe 88 PID 1772 wrote to memory of 4860 1772 3335.tmp 89 PID 1772 wrote to memory of 4860 1772 3335.tmp 89 PID 1772 wrote to memory of 4860 1772 3335.tmp 89 PID 4860 wrote to memory of 2980 4860 33C2.tmp 90 PID 4860 wrote to memory of 2980 4860 33C2.tmp 90 PID 4860 wrote to memory of 2980 4860 33C2.tmp 90 PID 2980 wrote to memory of 2168 2980 3420.tmp 91 PID 2980 wrote to memory of 2168 2980 3420.tmp 91 PID 2980 wrote to memory of 2168 2980 3420.tmp 91 PID 2168 wrote to memory of 3724 2168 34BC.tmp 92 PID 2168 wrote to memory of 3724 2168 34BC.tmp 92 PID 2168 wrote to memory of 3724 2168 34BC.tmp 92 PID 3724 wrote to memory of 1520 3724 351A.tmp 94 PID 3724 wrote to memory of 1520 3724 351A.tmp 94 PID 3724 wrote to memory of 1520 3724 351A.tmp 94 PID 1520 wrote to memory of 3272 1520 3577.tmp 96 PID 1520 wrote to memory of 3272 1520 3577.tmp 96 PID 1520 wrote to memory of 3272 1520 3577.tmp 96 PID 3272 wrote to memory of 4656 3272 35E5.tmp 98 PID 3272 wrote to memory of 4656 3272 35E5.tmp 98 PID 3272 wrote to memory of 4656 3272 35E5.tmp 98 PID 4656 wrote to memory of 832 4656 3652.tmp 99 PID 4656 wrote to memory of 832 4656 3652.tmp 99 PID 4656 wrote to memory of 832 4656 3652.tmp 99 PID 832 wrote to memory of 3024 832 36B0.tmp 100 PID 832 wrote to memory of 3024 832 36B0.tmp 100 PID 832 wrote to memory of 3024 832 36B0.tmp 100 PID 3024 wrote to memory of 1288 3024 372D.tmp 101 PID 3024 wrote to memory of 1288 3024 372D.tmp 101 PID 3024 wrote to memory of 1288 3024 372D.tmp 101 PID 1288 wrote to memory of 3908 1288 37AA.tmp 102 PID 1288 wrote to memory of 3908 1288 37AA.tmp 102 PID 1288 wrote to memory of 3908 1288 37AA.tmp 102 PID 3908 wrote to memory of 1532 3908 3808.tmp 103 PID 3908 wrote to memory of 1532 3908 3808.tmp 103 PID 3908 wrote to memory of 1532 3908 3808.tmp 103 PID 1532 wrote to memory of 3812 1532 3875.tmp 104 PID 1532 wrote to memory of 3812 1532 3875.tmp 104 PID 1532 wrote to memory of 3812 1532 3875.tmp 104 PID 3812 wrote to memory of 1152 3812 38D3.tmp 105 PID 3812 wrote to memory of 1152 3812 38D3.tmp 105 PID 3812 wrote to memory of 1152 3812 38D3.tmp 105 PID 1152 wrote to memory of 3372 1152 3950.tmp 106 PID 1152 wrote to memory of 3372 1152 3950.tmp 106 PID 1152 wrote to memory of 3372 1152 3950.tmp 106 PID 3372 wrote to memory of 1348 3372 39BD.tmp 107 PID 3372 wrote to memory of 1348 3372 39BD.tmp 107 PID 3372 wrote to memory of 1348 3372 39BD.tmp 107 PID 1348 wrote to memory of 4068 1348 3A0B.tmp 108 PID 1348 wrote to memory of 4068 1348 3A0B.tmp 108 PID 1348 wrote to memory of 4068 1348 3A0B.tmp 108 PID 4068 wrote to memory of 1528 4068 3A69.tmp 109 PID 4068 wrote to memory of 1528 4068 3A69.tmp 109 PID 4068 wrote to memory of 1528 4068 3A69.tmp 109 PID 1528 wrote to memory of 2784 1528 3AE6.tmp 110 PID 1528 wrote to memory of 2784 1528 3AE6.tmp 110 PID 1528 wrote to memory of 2784 1528 3AE6.tmp 110 PID 2784 wrote to memory of 4668 2784 3B44.tmp 111 PID 2784 wrote to memory of 4668 2784 3B44.tmp 111 PID 2784 wrote to memory of 4668 2784 3B44.tmp 111 PID 4668 wrote to memory of 836 4668 3BB1.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_aa635127a848c96c8d036c3cff8af273_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"23⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"24⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"25⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"26⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"27⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"28⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"29⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"30⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"31⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"32⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"33⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"34⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"35⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"36⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"37⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"38⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"39⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"40⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"41⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"42⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"43⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"44⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"45⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"46⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"47⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"48⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"49⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"50⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"51⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"52⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"53⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"54⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"55⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"56⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"57⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"58⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"59⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"60⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"61⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"62⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"63⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"64⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"65⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"66⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"68⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"69⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"70⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"71⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"72⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"73⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"74⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"75⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"76⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"77⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"78⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"79⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"80⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"81⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"82⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"83⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"84⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"85⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"86⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"87⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"88⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"89⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"90⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"91⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"92⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"94⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"95⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"96⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"97⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"99⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"100⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"101⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"102⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"103⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"104⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"105⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"106⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"107⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"108⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"109⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"110⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"111⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"112⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"113⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"114⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"115⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"116⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"117⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"118⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"119⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"120⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"121⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"122⤵PID:4036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-