Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe
-
Size
486KB
-
MD5
ef3df4661411acf82845eca749790716
-
SHA1
2e87d9ddaf75144d58cb44293e596395fd031645
-
SHA256
14069be93cb670356717776c1252b17a01e63c0511cecaa5684f907dad053911
-
SHA512
fd35c9eedb3e21fd779545a8415fe423fd3fec52b396c219a1f89ea4ed93e915dc5d708ea373df3b91e45f9696a93a7d218ce56a3aaaaa9161ce4af74479fbd6
-
SSDEEP
12288:/U5rCOTeiDwGhn4hjPcV5WB3jDbA9/idwxKy9BT:/UQOJDwG6258PA9/idwTXT
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1736 3671.tmp 3636 36EE.tmp 1648 376B.tmp 1068 37C9.tmp 4876 3827.tmp 3216 3894.tmp 4264 38E2.tmp 3036 3930.tmp 2220 398E.tmp 2884 39EC.tmp 60 3A3A.tmp 2140 3AA7.tmp 1452 3AF6.tmp 4484 3B63.tmp 3352 3BC1.tmp 3580 3C1E.tmp 1004 3C9B.tmp 648 3CEA.tmp 1428 3D57.tmp 4580 3DB5.tmp 4176 3E22.tmp 4288 3E9F.tmp 4064 3EFD.tmp 4016 3F6A.tmp 4488 3FC8.tmp 4744 4026.tmp 5076 4083.tmp 2696 40E1.tmp 2212 415E.tmp 2320 41BC.tmp 3488 4229.tmp 2172 4287.tmp 4440 42D5.tmp 3828 4333.tmp 2284 4391.tmp 3220 43EE.tmp 2420 444C.tmp 3636 44BA.tmp 2288 4527.tmp 4332 4585.tmp 684 45D3.tmp 3400 4631.tmp 5060 468E.tmp 3176 46DC.tmp 4728 473A.tmp 3892 4798.tmp 2424 47E6.tmp 1072 4844.tmp 4128 4892.tmp 3468 48E0.tmp 2008 492E.tmp 4008 498C.tmp 4088 49EA.tmp 2868 4A38.tmp 4976 4A86.tmp 2140 4AE4.tmp 2280 4B41.tmp 4828 4B90.tmp 2300 4BDE.tmp 636 4C2C.tmp 1836 4C7A.tmp 3492 4CD8.tmp 4920 4D26.tmp 3304 4D84.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 1736 2284 2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe 84 PID 2284 wrote to memory of 1736 2284 2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe 84 PID 2284 wrote to memory of 1736 2284 2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe 84 PID 1736 wrote to memory of 3636 1736 3671.tmp 86 PID 1736 wrote to memory of 3636 1736 3671.tmp 86 PID 1736 wrote to memory of 3636 1736 3671.tmp 86 PID 3636 wrote to memory of 1648 3636 36EE.tmp 88 PID 3636 wrote to memory of 1648 3636 36EE.tmp 88 PID 3636 wrote to memory of 1648 3636 36EE.tmp 88 PID 1648 wrote to memory of 1068 1648 376B.tmp 89 PID 1648 wrote to memory of 1068 1648 376B.tmp 89 PID 1648 wrote to memory of 1068 1648 376B.tmp 89 PID 1068 wrote to memory of 4876 1068 37C9.tmp 91 PID 1068 wrote to memory of 4876 1068 37C9.tmp 91 PID 1068 wrote to memory of 4876 1068 37C9.tmp 91 PID 4876 wrote to memory of 3216 4876 3827.tmp 92 PID 4876 wrote to memory of 3216 4876 3827.tmp 92 PID 4876 wrote to memory of 3216 4876 3827.tmp 92 PID 3216 wrote to memory of 4264 3216 3894.tmp 93 PID 3216 wrote to memory of 4264 3216 3894.tmp 93 PID 3216 wrote to memory of 4264 3216 3894.tmp 93 PID 4264 wrote to memory of 3036 4264 38E2.tmp 94 PID 4264 wrote to memory of 3036 4264 38E2.tmp 94 PID 4264 wrote to memory of 3036 4264 38E2.tmp 94 PID 3036 wrote to memory of 2220 3036 3930.tmp 95 PID 3036 wrote to memory of 2220 3036 3930.tmp 95 PID 3036 wrote to memory of 2220 3036 3930.tmp 95 PID 2220 wrote to memory of 2884 2220 398E.tmp 96 PID 2220 wrote to memory of 2884 2220 398E.tmp 96 PID 2220 wrote to memory of 2884 2220 398E.tmp 96 PID 2884 wrote to memory of 60 2884 39EC.tmp 98 PID 2884 wrote to memory of 60 2884 39EC.tmp 98 PID 2884 wrote to memory of 60 2884 39EC.tmp 98 PID 60 wrote to memory of 2140 60 3A3A.tmp 99 PID 60 wrote to memory of 2140 60 3A3A.tmp 99 PID 60 wrote to memory of 2140 60 3A3A.tmp 99 PID 2140 wrote to memory of 1452 2140 3AA7.tmp 100 PID 2140 wrote to memory of 1452 2140 3AA7.tmp 100 PID 2140 wrote to memory of 1452 2140 3AA7.tmp 100 PID 1452 wrote to memory of 4484 1452 3AF6.tmp 101 PID 1452 wrote to memory of 4484 1452 3AF6.tmp 101 PID 1452 wrote to memory of 4484 1452 3AF6.tmp 101 PID 4484 wrote to memory of 3352 4484 3B63.tmp 102 PID 4484 wrote to memory of 3352 4484 3B63.tmp 102 PID 4484 wrote to memory of 3352 4484 3B63.tmp 102 PID 3352 wrote to memory of 3580 3352 3BC1.tmp 103 PID 3352 wrote to memory of 3580 3352 3BC1.tmp 103 PID 3352 wrote to memory of 3580 3352 3BC1.tmp 103 PID 3580 wrote to memory of 1004 3580 3C1E.tmp 104 PID 3580 wrote to memory of 1004 3580 3C1E.tmp 104 PID 3580 wrote to memory of 1004 3580 3C1E.tmp 104 PID 1004 wrote to memory of 648 1004 3C9B.tmp 105 PID 1004 wrote to memory of 648 1004 3C9B.tmp 105 PID 1004 wrote to memory of 648 1004 3C9B.tmp 105 PID 648 wrote to memory of 1428 648 3CEA.tmp 106 PID 648 wrote to memory of 1428 648 3CEA.tmp 106 PID 648 wrote to memory of 1428 648 3CEA.tmp 106 PID 1428 wrote to memory of 4580 1428 3D57.tmp 107 PID 1428 wrote to memory of 4580 1428 3D57.tmp 107 PID 1428 wrote to memory of 4580 1428 3D57.tmp 107 PID 4580 wrote to memory of 4176 4580 3DB5.tmp 108 PID 4580 wrote to memory of 4176 4580 3DB5.tmp 108 PID 4580 wrote to memory of 4176 4580 3DB5.tmp 108 PID 4176 wrote to memory of 4288 4176 3E22.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_ef3df4661411acf82845eca749790716_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"23⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"24⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"25⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"26⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"27⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"28⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"29⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"30⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"31⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"32⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"33⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"34⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"35⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"36⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"37⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"38⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"39⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"40⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"41⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"42⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"43⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"44⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"45⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"46⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"47⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"48⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"49⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"50⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"51⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"52⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"53⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"54⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"55⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"56⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"57⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"58⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"59⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"60⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"61⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"62⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"63⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"64⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"65⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"66⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"67⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"68⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"69⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"70⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"71⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"72⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"73⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"74⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"75⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"76⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"77⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"78⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"79⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"80⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"81⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"82⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"83⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"84⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"85⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"86⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"87⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"89⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"90⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"91⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"92⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"93⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"94⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"95⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"96⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"97⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"98⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"99⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"100⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"101⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"102⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"103⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"104⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"105⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"106⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"107⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"108⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"109⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"110⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"111⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"112⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"113⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"114⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"115⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"116⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"117⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"118⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"119⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"120⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"121⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"122⤵PID:1972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-