Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe
-
Size
486KB
-
MD5
c2ed9e0cc62e25e257a851f1fc7a3870
-
SHA1
26a5ed9baa1ab7c41559e8ab4aaea16830c24703
-
SHA256
566d5d33cfba4e200e9ff96a7be263c97e1d461ab352c922abbf45d5c78bd8f7
-
SHA512
f99a30db9644641627bebd5460484169e4bbc1cfb39ff0c913ee8db65c1e125ba5652849d2c39d9772c264b8ef4e9f278307ccf93553297559e451d1508a4a0e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJbqWwULOBARzk/3k9ODD20UgOw8rsW4hxWQSQ:/U5rCOTeiDwWwUzk/0UPxPW1QhiNzFP
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2024 EE86.tmp 3328 F04B.tmp 3232 F107.tmp 5112 F1D2.tmp 3936 F2BC.tmp 4580 F378.tmp 1280 F453.tmp 696 F5D9.tmp 4392 F712.tmp 3132 F7BE.tmp 4608 F898.tmp 3732 F944.tmp 2100 FA00.tmp 2556 FAEA.tmp 3412 FBB5.tmp 1544 FCA0.tmp 3636 FD6B.tmp 1500 FE26.tmp 4772 FF01.tmp 2308 A7.tmp 3896 172.tmp 4312 20E.tmp 4292 308.tmp 1388 385.tmp 4240 50C.tmp 4452 6B2.tmp 4384 7AC.tmp 4704 877.tmp 3760 932.tmp 1760 9BF.tmp 2424 B17.tmp 4060 C01.tmp 4720 CDC.tmp 2156 D59.tmp 4804 DF5.tmp 2096 EC0.tmp 320 F6C.tmp 4432 1008.tmp 2088 1076.tmp 4184 10F3.tmp 3552 117F.tmp 2968 124B.tmp 2920 12C8.tmp 3788 1364.tmp 2488 1400.tmp 2168 147D.tmp 4688 1539.tmp 2596 15E4.tmp 4504 1671.tmp 4580 16FE.tmp 4952 178A.tmp 2496 17F8.tmp 488 18A4.tmp 1872 1911.tmp 1732 199E.tmp 2280 1A2A.tmp 4372 1AC6.tmp 1504 1B43.tmp 2100 1BD0.tmp 4080 1C3D.tmp 2292 1CBA.tmp 1600 1D37.tmp 3256 1DB4.tmp 5008 1E51.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3400 wrote to memory of 2024 3400 2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe 91 PID 3400 wrote to memory of 2024 3400 2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe 91 PID 3400 wrote to memory of 2024 3400 2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe 91 PID 2024 wrote to memory of 3328 2024 EE86.tmp 92 PID 2024 wrote to memory of 3328 2024 EE86.tmp 92 PID 2024 wrote to memory of 3328 2024 EE86.tmp 92 PID 3328 wrote to memory of 3232 3328 F04B.tmp 93 PID 3328 wrote to memory of 3232 3328 F04B.tmp 93 PID 3328 wrote to memory of 3232 3328 F04B.tmp 93 PID 3232 wrote to memory of 5112 3232 F107.tmp 94 PID 3232 wrote to memory of 5112 3232 F107.tmp 94 PID 3232 wrote to memory of 5112 3232 F107.tmp 94 PID 5112 wrote to memory of 3936 5112 F1D2.tmp 95 PID 5112 wrote to memory of 3936 5112 F1D2.tmp 95 PID 5112 wrote to memory of 3936 5112 F1D2.tmp 95 PID 3936 wrote to memory of 4580 3936 F2BC.tmp 96 PID 3936 wrote to memory of 4580 3936 F2BC.tmp 96 PID 3936 wrote to memory of 4580 3936 F2BC.tmp 96 PID 4580 wrote to memory of 1280 4580 F378.tmp 97 PID 4580 wrote to memory of 1280 4580 F378.tmp 97 PID 4580 wrote to memory of 1280 4580 F378.tmp 97 PID 1280 wrote to memory of 696 1280 F453.tmp 98 PID 1280 wrote to memory of 696 1280 F453.tmp 98 PID 1280 wrote to memory of 696 1280 F453.tmp 98 PID 696 wrote to memory of 4392 696 F5D9.tmp 99 PID 696 wrote to memory of 4392 696 F5D9.tmp 99 PID 696 wrote to memory of 4392 696 F5D9.tmp 99 PID 4392 wrote to memory of 3132 4392 F712.tmp 100 PID 4392 wrote to memory of 3132 4392 F712.tmp 100 PID 4392 wrote to memory of 3132 4392 F712.tmp 100 PID 3132 wrote to memory of 4608 3132 F7BE.tmp 101 PID 3132 wrote to memory of 4608 3132 F7BE.tmp 101 PID 3132 wrote to memory of 4608 3132 F7BE.tmp 101 PID 4608 wrote to memory of 3732 4608 F898.tmp 102 PID 4608 wrote to memory of 3732 4608 F898.tmp 102 PID 4608 wrote to memory of 3732 4608 F898.tmp 102 PID 3732 wrote to memory of 2100 3732 F944.tmp 103 PID 3732 wrote to memory of 2100 3732 F944.tmp 103 PID 3732 wrote to memory of 2100 3732 F944.tmp 103 PID 2100 wrote to memory of 2556 2100 FA00.tmp 104 PID 2100 wrote to memory of 2556 2100 FA00.tmp 104 PID 2100 wrote to memory of 2556 2100 FA00.tmp 104 PID 2556 wrote to memory of 3412 2556 FAEA.tmp 105 PID 2556 wrote to memory of 3412 2556 FAEA.tmp 105 PID 2556 wrote to memory of 3412 2556 FAEA.tmp 105 PID 3412 wrote to memory of 1544 3412 FBB5.tmp 106 PID 3412 wrote to memory of 1544 3412 FBB5.tmp 106 PID 3412 wrote to memory of 1544 3412 FBB5.tmp 106 PID 1544 wrote to memory of 3636 1544 FCA0.tmp 107 PID 1544 wrote to memory of 3636 1544 FCA0.tmp 107 PID 1544 wrote to memory of 3636 1544 FCA0.tmp 107 PID 3636 wrote to memory of 1500 3636 FD6B.tmp 108 PID 3636 wrote to memory of 1500 3636 FD6B.tmp 108 PID 3636 wrote to memory of 1500 3636 FD6B.tmp 108 PID 1500 wrote to memory of 4772 1500 FE26.tmp 109 PID 1500 wrote to memory of 4772 1500 FE26.tmp 109 PID 1500 wrote to memory of 4772 1500 FE26.tmp 109 PID 4772 wrote to memory of 2308 4772 FF01.tmp 110 PID 4772 wrote to memory of 2308 4772 FF01.tmp 110 PID 4772 wrote to memory of 2308 4772 FF01.tmp 110 PID 2308 wrote to memory of 3896 2308 A7.tmp 111 PID 2308 wrote to memory of 3896 2308 A7.tmp 111 PID 2308 wrote to memory of 3896 2308 A7.tmp 111 PID 3896 wrote to memory of 4312 3896 172.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_c2ed9e0cc62e25e257a851f1fc7a3870_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"23⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"24⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"25⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"26⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"27⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"28⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"29⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"30⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"31⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"32⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"33⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"34⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"35⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"36⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"37⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"38⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"39⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"40⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"41⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"42⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"43⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"44⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"45⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"46⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"47⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"48⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"49⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"50⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"51⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"52⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"53⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"54⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"55⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"56⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"57⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"58⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"59⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"60⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"61⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"62⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"63⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"64⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"65⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"66⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"67⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"68⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"69⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"70⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"71⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"72⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"73⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"74⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"75⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"76⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"77⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"78⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"79⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"80⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"81⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"82⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"83⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"84⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"85⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"87⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"88⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"89⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"90⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"91⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"92⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"93⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"94⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"95⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"96⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"97⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"98⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"99⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"100⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"101⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"102⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"103⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"104⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"105⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"106⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"107⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"108⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"109⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"110⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"111⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"112⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"113⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"114⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"115⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"116⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"117⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"118⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"119⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"122⤵PID:1764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-