Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/03/2024, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
- Target 2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe
- Size 486KB
- Sample240319-gdz4fabb92
- SHA256 6f893a830d307f9ad80280eec92ad7cd903cf251eb7c3e2ba707aabf3d5b399f
- MD5 0bf3bcd7fdf5e04d54ce512cc747d4e9
- SHA1 7020c52311153af79a098e9ac4f7f868e6983324
- SHA512 15ac694c3b22e986c213b4161857a4bfa5bacfd0e45a779660ea69fb51c6d3b3d59e9a8c9466af3080493e249e74ac14a9be3c35b69a9bbe44486f63e80f0e9d
- SSDEEP 6144:Forf3lPvovsgZnqG2C7mOTeiLfD70/IIW9ZvW8P1Vj467456XKvRswYcFsH3dZ:UU5rCOTeiDOIIWRPrr4gXKZINZ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4876 2EC1.tmp 4568 2F4D.tmp 1592 2FBB.tmp 680 3028.tmp 4656 3086.tmp 3340 30E3.tmp 1100 3132.tmp 2872 318F.tmp 100 31DD.tmp 384 324B.tmp 3060 3299.tmp 1932 32F7.tmp 1000 3345.tmp 2948 3393.tmp 2856 33E1.tmp 4536 344E.tmp 1856 34AC.tmp 3780 351A.tmp 3496 3568.tmp 2716 35D5.tmp 4132 3623.tmp 4768 36A0.tmp 2332 370E.tmp 1976 378B.tmp 1504 3808.tmp 4872 3865.tmp 4524 38D3.tmp 4324 3930.tmp 4004 397F.tmp 2316 39DC.tmp 4456 3A3A.tmp 5036 3AA7.tmp 3180 3B15.tmp 3776 3B63.tmp 4412 3BB1.tmp 852 3BFF.tmp 2356 3C5D.tmp 3280 3CAB.tmp 4576 3D09.tmp 2252 3D57.tmp 4948 3DA5.tmp 100 3E22.tmp 1660 3E80.tmp 3060 3ECE.tmp 3520 3F1C.tmp 2952 3F7A.tmp 2820 3FC8.tmp 2948 4016.tmp 1868 4064.tmp 2116 40B2.tmp 4536 4100.tmp 2692 414F.tmp 2560 419D.tmp 4684 41EB.tmp 3316 4249.tmp 4180 4297.tmp 2264 42E5.tmp 3052 4343.tmp 3620 4391.tmp 2332 43DF.tmp 4288 442D.tmp 1976 447B.tmp 4020 44D9.tmp 2112 4527.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 4876 3804 2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe 89 PID 3804 wrote to memory of 4876 3804 2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe 89 PID 3804 wrote to memory of 4876 3804 2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe 89 PID 4876 wrote to memory of 4568 4876 2EC1.tmp 90 PID 4876 wrote to memory of 4568 4876 2EC1.tmp 90 PID 4876 wrote to memory of 4568 4876 2EC1.tmp 90 PID 4568 wrote to memory of 1592 4568 2F4D.tmp 91 PID 4568 wrote to memory of 1592 4568 2F4D.tmp 91 PID 4568 wrote to memory of 1592 4568 2F4D.tmp 91 PID 1592 wrote to memory of 680 1592 2FBB.tmp 92 PID 1592 wrote to memory of 680 1592 2FBB.tmp 92 PID 1592 wrote to memory of 680 1592 2FBB.tmp 92 PID 680 wrote to memory of 4656 680 3028.tmp 95 PID 680 wrote to memory of 4656 680 3028.tmp 95 PID 680 wrote to memory of 4656 680 3028.tmp 95 PID 4656 wrote to memory of 3340 4656 3086.tmp 97 PID 4656 wrote to memory of 3340 4656 3086.tmp 97 PID 4656 wrote to memory of 3340 4656 3086.tmp 97 PID 3340 wrote to memory of 1100 3340 30E3.tmp 98 PID 3340 wrote to memory of 1100 3340 30E3.tmp 98 PID 3340 wrote to memory of 1100 3340 30E3.tmp 98 PID 1100 wrote to memory of 2872 1100 3132.tmp 99 PID 1100 wrote to memory of 2872 1100 3132.tmp 99 PID 1100 wrote to memory of 2872 1100 3132.tmp 99 PID 2872 wrote to memory of 100 2872 318F.tmp 100 PID 2872 wrote to memory of 100 2872 318F.tmp 100 PID 2872 wrote to memory of 100 2872 318F.tmp 100 PID 100 wrote to memory of 384 100 31DD.tmp 101 PID 100 wrote to memory of 384 100 31DD.tmp 101 PID 100 wrote to memory of 384 100 31DD.tmp 101 PID 384 wrote to memory of 3060 384 324B.tmp 102 PID 384 wrote to memory of 3060 384 324B.tmp 102 PID 384 wrote to memory of 3060 384 324B.tmp 102 PID 3060 wrote to memory of 1932 3060 3299.tmp 103 PID 3060 wrote to memory of 1932 3060 3299.tmp 103 PID 3060 wrote to memory of 1932 3060 3299.tmp 103 PID 1932 wrote to memory of 1000 1932 32F7.tmp 104 PID 1932 wrote to memory of 1000 1932 32F7.tmp 104 PID 1932 wrote to memory of 1000 1932 32F7.tmp 104 PID 1000 wrote to memory of 2948 1000 3345.tmp 105 PID 1000 wrote to memory of 2948 1000 3345.tmp 105 PID 1000 wrote to memory of 2948 1000 3345.tmp 105 PID 2948 wrote to memory of 2856 2948 3393.tmp 106 PID 2948 wrote to memory of 2856 2948 3393.tmp 106 PID 2948 wrote to memory of 2856 2948 3393.tmp 106 PID 2856 wrote to memory of 4536 2856 33E1.tmp 107 PID 2856 wrote to memory of 4536 2856 33E1.tmp 107 PID 2856 wrote to memory of 4536 2856 33E1.tmp 107 PID 4536 wrote to memory of 1856 4536 344E.tmp 108 PID 4536 wrote to memory of 1856 4536 344E.tmp 108 PID 4536 wrote to memory of 1856 4536 344E.tmp 108 PID 1856 wrote to memory of 3780 1856 34AC.tmp 109 PID 1856 wrote to memory of 3780 1856 34AC.tmp 109 PID 1856 wrote to memory of 3780 1856 34AC.tmp 109 PID 3780 wrote to memory of 3496 3780 351A.tmp 110 PID 3780 wrote to memory of 3496 3780 351A.tmp 110 PID 3780 wrote to memory of 3496 3780 351A.tmp 110 PID 3496 wrote to memory of 2716 3496 3568.tmp 111 PID 3496 wrote to memory of 2716 3496 3568.tmp 111 PID 3496 wrote to memory of 2716 3496 3568.tmp 111 PID 2716 wrote to memory of 4132 2716 35D5.tmp 112 PID 2716 wrote to memory of 4132 2716 35D5.tmp 112 PID 2716 wrote to memory of 4132 2716 35D5.tmp 112 PID 4132 wrote to memory of 4768 4132 3623.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_0bf3bcd7fdf5e04d54ce512cc747d4e9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3086.tmp"C:\Users\Admin\AppData\Local\Temp\3086.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"23⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"24⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"25⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"26⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"27⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"28⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"29⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"30⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"31⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"32⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"33⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"34⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"35⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"36⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"37⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"38⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"39⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"40⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"41⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"42⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"43⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"44⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"45⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"46⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"47⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"48⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"49⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"50⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"51⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"52⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"53⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"54⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"55⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"56⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"57⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"58⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"59⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"60⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"61⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"62⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"63⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"64⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"65⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"66⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"67⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"68⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"69⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"70⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"71⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"72⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"73⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"74⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"75⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"76⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"77⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"78⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"79⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"80⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"81⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"82⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"83⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"84⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"85⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"86⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"87⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"89⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"90⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"91⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"92⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"93⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"94⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"95⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"96⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"97⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"98⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"99⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"100⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"101⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"102⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"103⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"104⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"105⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"106⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"107⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"108⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"109⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"111⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"112⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"113⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"114⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"115⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"116⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"117⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"118⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"119⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"120⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"121⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"122⤵PID:432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-