Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe
- Size 541KB
- Sample240527-pfc1pacf23
- SHA256 be16ac0ac83c5f9d1b084e694b50e866390d88c9bfcfce7307ddd88f208050a1
- MD5 0bf1e172cd1f39b87140b11c354ad892
- SHA1 3a8f0825176add8bf22e868773d10db67cfccd8e
- SHA512 5ddaa632601d2ab2ceac799fc8ea6edb16cd24d2238ae5e4f65ea2fe55906f77f6558787cbfc3578f96cce0d59e6384328df1ef564dcf50bf8607b94b6326c1b
- SSDEEP 12288:UU5rCOTeifD1USHRxBqgyB5+bw9jfrZa73ctO:UUQOJfhtnBTyB5+kRfrU73ctO
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 752 3AF6.tmp 1964 3BB1.tmp 2496 3C1E.tmp 1632 3CEA.tmp 4692 3D67.tmp 2612 3DD4.tmp 2592 3E41.tmp 3580 3ECE.tmp 3932 3F1C.tmp 2568 3F89.tmp 3248 4016.tmp 1896 4083.tmp 1392 40E1.tmp 4504 415E.tmp 4908 41BC.tmp 4444 4371.tmp 1456 43CF.tmp 1520 444C.tmp 4336 44BA.tmp 4216 4527.tmp 2220 45B4.tmp 1728 465F.tmp 2332 46EC.tmp 3292 4788.tmp 3268 47E6.tmp 1720 4844.tmp 4776 48A2.tmp 3620 491F.tmp 4436 49AB.tmp 3296 4A09.tmp 2092 4A96.tmp 3524 4B13.tmp 1980 4B9F.tmp 2352 4BED.tmp 3276 4C3B.tmp 4200 4C99.tmp 1028 4D07.tmp 1384 4D64.tmp 3128 4DB2.tmp 2184 4E01.tmp 4416 4E4F.tmp 2468 4E9D.tmp 2576 4EEB.tmp 2688 4F49.tmp 4524 4F97.tmp 3248 4FF5.tmp 1896 5052.tmp 3204 50A0.tmp 3824 50EF.tmp 1252 514C.tmp 1624 51AA.tmp 4444 51F8.tmp 4536 5256.tmp 1200 52B4.tmp 1520 5311.tmp 3928 536F.tmp 1152 53BD.tmp 2068 541B.tmp 1772 5469.tmp 936 54C7.tmp 1904 5525.tmp 5012 5573.tmp 4192 55C1.tmp 4420 561F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1084 wrote to memory of 752 1084 2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe 83 PID 1084 wrote to memory of 752 1084 2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe 83 PID 1084 wrote to memory of 752 1084 2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe 83 PID 752 wrote to memory of 1964 752 3AF6.tmp 84 PID 752 wrote to memory of 1964 752 3AF6.tmp 84 PID 752 wrote to memory of 1964 752 3AF6.tmp 84 PID 1964 wrote to memory of 2496 1964 3BB1.tmp 85 PID 1964 wrote to memory of 2496 1964 3BB1.tmp 85 PID 1964 wrote to memory of 2496 1964 3BB1.tmp 85 PID 2496 wrote to memory of 1632 2496 3C1E.tmp 86 PID 2496 wrote to memory of 1632 2496 3C1E.tmp 86 PID 2496 wrote to memory of 1632 2496 3C1E.tmp 86 PID 1632 wrote to memory of 4692 1632 3CEA.tmp 87 PID 1632 wrote to memory of 4692 1632 3CEA.tmp 87 PID 1632 wrote to memory of 4692 1632 3CEA.tmp 87 PID 4692 wrote to memory of 2612 4692 3D67.tmp 88 PID 4692 wrote to memory of 2612 4692 3D67.tmp 88 PID 4692 wrote to memory of 2612 4692 3D67.tmp 88 PID 2612 wrote to memory of 2592 2612 3DD4.tmp 90 PID 2612 wrote to memory of 2592 2612 3DD4.tmp 90 PID 2612 wrote to memory of 2592 2612 3DD4.tmp 90 PID 2592 wrote to memory of 3580 2592 3E41.tmp 91 PID 2592 wrote to memory of 3580 2592 3E41.tmp 91 PID 2592 wrote to memory of 3580 2592 3E41.tmp 91 PID 3580 wrote to memory of 3932 3580 3ECE.tmp 92 PID 3580 wrote to memory of 3932 3580 3ECE.tmp 92 PID 3580 wrote to memory of 3932 3580 3ECE.tmp 92 PID 3932 wrote to memory of 2568 3932 3F1C.tmp 94 PID 3932 wrote to memory of 2568 3932 3F1C.tmp 94 PID 3932 wrote to memory of 2568 3932 3F1C.tmp 94 PID 2568 wrote to memory of 3248 2568 3F89.tmp 96 PID 2568 wrote to memory of 3248 2568 3F89.tmp 96 PID 2568 wrote to memory of 3248 2568 3F89.tmp 96 PID 3248 wrote to memory of 1896 3248 4016.tmp 97 PID 3248 wrote to memory of 1896 3248 4016.tmp 97 PID 3248 wrote to memory of 1896 3248 4016.tmp 97 PID 1896 wrote to memory of 1392 1896 4083.tmp 98 PID 1896 wrote to memory of 1392 1896 4083.tmp 98 PID 1896 wrote to memory of 1392 1896 4083.tmp 98 PID 1392 wrote to memory of 4504 1392 40E1.tmp 99 PID 1392 wrote to memory of 4504 1392 40E1.tmp 99 PID 1392 wrote to memory of 4504 1392 40E1.tmp 99 PID 4504 wrote to memory of 4908 4504 415E.tmp 100 PID 4504 wrote to memory of 4908 4504 415E.tmp 100 PID 4504 wrote to memory of 4908 4504 415E.tmp 100 PID 4908 wrote to memory of 4444 4908 41BC.tmp 101 PID 4908 wrote to memory of 4444 4908 41BC.tmp 101 PID 4908 wrote to memory of 4444 4908 41BC.tmp 101 PID 4444 wrote to memory of 1456 4444 4371.tmp 102 PID 4444 wrote to memory of 1456 4444 4371.tmp 102 PID 4444 wrote to memory of 1456 4444 4371.tmp 102 PID 1456 wrote to memory of 1520 1456 43CF.tmp 105 PID 1456 wrote to memory of 1520 1456 43CF.tmp 105 PID 1456 wrote to memory of 1520 1456 43CF.tmp 105 PID 1520 wrote to memory of 4336 1520 444C.tmp 106 PID 1520 wrote to memory of 4336 1520 444C.tmp 106 PID 1520 wrote to memory of 4336 1520 444C.tmp 106 PID 4336 wrote to memory of 4216 4336 44BA.tmp 107 PID 4336 wrote to memory of 4216 4336 44BA.tmp 107 PID 4336 wrote to memory of 4216 4336 44BA.tmp 107 PID 4216 wrote to memory of 2220 4216 4527.tmp 108 PID 4216 wrote to memory of 2220 4216 4527.tmp 108 PID 4216 wrote to memory of 2220 4216 4527.tmp 108 PID 2220 wrote to memory of 1728 2220 45B4.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_0bf1e172cd1f39b87140b11c354ad892_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"23⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"24⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"25⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"26⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"27⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"28⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"29⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"30⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"31⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"32⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"33⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"34⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"35⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"36⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"37⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"38⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"39⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"40⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"41⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"42⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"43⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"44⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"45⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"46⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"47⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"48⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"49⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"50⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"51⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"52⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"53⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"54⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"55⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"56⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"57⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"58⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"59⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"60⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"61⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"62⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"63⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"64⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"65⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"66⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"67⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"68⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"69⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"70⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"71⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"72⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"73⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"74⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"75⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"76⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"77⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"78⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"79⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"80⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"81⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"82⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"83⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"84⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"85⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"86⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"87⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"88⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"89⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"91⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"92⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"93⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"94⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"95⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"96⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"97⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"98⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"99⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"100⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"101⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"102⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"103⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"104⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"105⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"106⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"107⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"109⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"110⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"111⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"112⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"113⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"114⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"115⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"116⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"117⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"118⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"119⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"120⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"121⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"122⤵PID:3372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-