Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe
-
Size
486KB
-
MD5
28dbe9a15a524e91c0a2a032c7d84599
-
SHA1
3a766b386574641aeb30738e6dc659317f68ad01
-
SHA256
664b72e9ad69df3512599f75eac6d4684018438c8346bf845a8c62cedf06dd13
-
SHA512
2628e049cb78411b5ac4e074336872ddc8eca82b4f96a200d678ca046fad4214b73ce9980fba19c6242f674a046bc0204f043ba29416714bcd8f8b3a3972c55a
-
SSDEEP
12288:/U5rCOTeiDrZgV4eJLEkXUqwY40LgQ5BzjRqmNZ:/UQOJDrZ25BRLgQ55AmN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2344 2EEF.tmp 1988 2F5D.tmp 3780 2FBB.tmp 4800 3038.tmp 4688 30A5.tmp 4756 3103.tmp 2728 3160.tmp 1136 31AF.tmp 4304 320C.tmp 2072 325A.tmp 4852 32B8.tmp 4820 3316.tmp 4588 3364.tmp 3500 33D1.tmp 4676 342F.tmp 1376 349D.tmp 4044 350A.tmp 3472 3558.tmp 1008 35D5.tmp 3148 3633.tmp 4268 36A0.tmp 3984 36EE.tmp 4552 375C.tmp 4060 37AA.tmp 4004 3817.tmp 2788 3865.tmp 3556 38B3.tmp 2580 3902.tmp 3700 3950.tmp 4408 39AD.tmp 1216 3A0B.tmp 772 3A59.tmp 1920 3AC7.tmp 3660 3B15.tmp 748 3B63.tmp 3520 3BC1.tmp 3152 3C0F.tmp 3080 3C6D.tmp 4504 3CCA.tmp 4808 3D28.tmp 3720 3D76.tmp 1472 3DD4.tmp 4796 3E22.tmp 4732 3E80.tmp 4460 3ECE.tmp 1664 3F1C.tmp 4264 3F6A.tmp 3796 3FC8.tmp 5108 4016.tmp 2612 4064.tmp 4448 40B2.tmp 4812 4110.tmp 4568 416E.tmp 3300 41CC.tmp 1300 4229.tmp 1388 4287.tmp 5020 42D5.tmp 4292 4323.tmp 884 4371.tmp 4588 43C0.tmp 3928 440E.tmp 928 446B.tmp 2852 44BA.tmp 2224 4508.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2344 2488 2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe 89 PID 2488 wrote to memory of 2344 2488 2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe 89 PID 2488 wrote to memory of 2344 2488 2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe 89 PID 2344 wrote to memory of 1988 2344 2EEF.tmp 90 PID 2344 wrote to memory of 1988 2344 2EEF.tmp 90 PID 2344 wrote to memory of 1988 2344 2EEF.tmp 90 PID 1988 wrote to memory of 3780 1988 2F5D.tmp 91 PID 1988 wrote to memory of 3780 1988 2F5D.tmp 91 PID 1988 wrote to memory of 3780 1988 2F5D.tmp 91 PID 3780 wrote to memory of 4800 3780 2FBB.tmp 92 PID 3780 wrote to memory of 4800 3780 2FBB.tmp 92 PID 3780 wrote to memory of 4800 3780 2FBB.tmp 92 PID 4800 wrote to memory of 4688 4800 3038.tmp 93 PID 4800 wrote to memory of 4688 4800 3038.tmp 93 PID 4800 wrote to memory of 4688 4800 3038.tmp 93 PID 4688 wrote to memory of 4756 4688 30A5.tmp 94 PID 4688 wrote to memory of 4756 4688 30A5.tmp 94 PID 4688 wrote to memory of 4756 4688 30A5.tmp 94 PID 4756 wrote to memory of 2728 4756 3103.tmp 95 PID 4756 wrote to memory of 2728 4756 3103.tmp 95 PID 4756 wrote to memory of 2728 4756 3103.tmp 95 PID 2728 wrote to memory of 1136 2728 3160.tmp 96 PID 2728 wrote to memory of 1136 2728 3160.tmp 96 PID 2728 wrote to memory of 1136 2728 3160.tmp 96 PID 1136 wrote to memory of 4304 1136 31AF.tmp 97 PID 1136 wrote to memory of 4304 1136 31AF.tmp 97 PID 1136 wrote to memory of 4304 1136 31AF.tmp 97 PID 4304 wrote to memory of 2072 4304 320C.tmp 98 PID 4304 wrote to memory of 2072 4304 320C.tmp 98 PID 4304 wrote to memory of 2072 4304 320C.tmp 98 PID 2072 wrote to memory of 4852 2072 325A.tmp 99 PID 2072 wrote to memory of 4852 2072 325A.tmp 99 PID 2072 wrote to memory of 4852 2072 325A.tmp 99 PID 4852 wrote to memory of 4820 4852 32B8.tmp 100 PID 4852 wrote to memory of 4820 4852 32B8.tmp 100 PID 4852 wrote to memory of 4820 4852 32B8.tmp 100 PID 4820 wrote to memory of 4588 4820 3316.tmp 101 PID 4820 wrote to memory of 4588 4820 3316.tmp 101 PID 4820 wrote to memory of 4588 4820 3316.tmp 101 PID 4588 wrote to memory of 3500 4588 3364.tmp 102 PID 4588 wrote to memory of 3500 4588 3364.tmp 102 PID 4588 wrote to memory of 3500 4588 3364.tmp 102 PID 3500 wrote to memory of 4676 3500 33D1.tmp 103 PID 3500 wrote to memory of 4676 3500 33D1.tmp 103 PID 3500 wrote to memory of 4676 3500 33D1.tmp 103 PID 4676 wrote to memory of 1376 4676 342F.tmp 104 PID 4676 wrote to memory of 1376 4676 342F.tmp 104 PID 4676 wrote to memory of 1376 4676 342F.tmp 104 PID 1376 wrote to memory of 4044 1376 349D.tmp 105 PID 1376 wrote to memory of 4044 1376 349D.tmp 105 PID 1376 wrote to memory of 4044 1376 349D.tmp 105 PID 4044 wrote to memory of 3472 4044 350A.tmp 106 PID 4044 wrote to memory of 3472 4044 350A.tmp 106 PID 4044 wrote to memory of 3472 4044 350A.tmp 106 PID 3472 wrote to memory of 1008 3472 3558.tmp 107 PID 3472 wrote to memory of 1008 3472 3558.tmp 107 PID 3472 wrote to memory of 1008 3472 3558.tmp 107 PID 1008 wrote to memory of 3148 1008 35D5.tmp 108 PID 1008 wrote to memory of 3148 1008 35D5.tmp 108 PID 1008 wrote to memory of 3148 1008 35D5.tmp 108 PID 3148 wrote to memory of 4268 3148 3633.tmp 109 PID 3148 wrote to memory of 4268 3148 3633.tmp 109 PID 3148 wrote to memory of 4268 3148 3633.tmp 109 PID 4268 wrote to memory of 3984 4268 36A0.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_28dbe9a15a524e91c0a2a032c7d84599_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3103.tmp"C:\Users\Admin\AppData\Local\Temp\3103.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3160.tmp"C:\Users\Admin\AppData\Local\Temp\3160.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\31AF.tmp"C:\Users\Admin\AppData\Local\Temp\31AF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"23⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"24⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"25⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"26⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"27⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"28⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"29⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"30⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"31⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"32⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"33⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"34⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"35⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"36⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"37⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"38⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"39⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"40⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"41⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"42⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"43⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"44⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"45⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"46⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"47⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"48⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"49⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"50⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"51⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"52⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"53⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"54⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"55⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"56⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"57⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"58⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"59⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"60⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"61⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"62⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"63⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"64⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"65⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"66⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"67⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"68⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"69⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"70⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"71⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"72⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"73⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"75⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"76⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"77⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"78⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"79⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"80⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"81⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"82⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"83⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"84⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"85⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"86⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"87⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"88⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"89⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"90⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"91⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"92⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"93⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"94⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"95⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"96⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"97⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"98⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"99⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"100⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"101⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"102⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"103⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"104⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"105⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"106⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"107⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"108⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"109⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"110⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"111⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"112⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"113⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"114⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"115⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"116⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"117⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"118⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"120⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"121⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-