Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
-
Size
487KB
-
MD5
e64fa3be163095d4b6f16d5cde000beb
-
SHA1
6868cb3950df9a4cc7ef9d17497addfdf2e6055e
-
SHA256
18d89ca7858d149bc8ff4aae193d8c6171ad6e0c48190df54b02dd0b2a87ba92
-
SHA512
a2a7bd8a509330d5643320837ec3e1aa43359298ff3f5e836fe41db1dc3198647777892cd96d49ddf664b9995638f4cc8918bac2c7695d76195b938ec90eeea5
-
SSDEEP
12288:HU5rCOTeiJoCShzloEL3bb8zfjPGbZlNZ:HUQOJJoqEnb8zab7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2460 350A.tmp 2052 3587.tmp 1976 35F4.tmp 3232 3662.tmp 312 36BF.tmp 5112 373C.tmp 4656 378B.tmp 3488 37E8.tmp 1252 3856.tmp 2504 38A4.tmp 3580 3921.tmp 2520 399E.tmp 4892 3A0B.tmp 4664 3A69.tmp 1220 3AD6.tmp 1844 3B44.tmp 4064 3BC1.tmp 3516 3C2E.tmp 216 3CCA.tmp 2040 3D28.tmp 4520 3DA5.tmp 2216 3E03.tmp 2036 3E61.tmp 1184 3ECE.tmp 3336 3F1C.tmp 4316 3F6A.tmp 4504 3FC8.tmp 3660 4035.tmp 4556 4093.tmp 1852 4110.tmp 3160 419D.tmp 4432 420A.tmp 1344 4287.tmp 4512 42D5.tmp 964 4333.tmp 1052 4391.tmp 2296 43DF.tmp 1080 442D.tmp 4464 447B.tmp 1504 44C9.tmp 640 4527.tmp 716 4585.tmp 3488 45D3.tmp 5104 4631.tmp 2208 468E.tmp 4264 46DC.tmp 3580 473A.tmp 776 4798.tmp 4892 47F6.tmp 4356 4844.tmp 1008 4892.tmp 1876 48FF.tmp 1660 497C.tmp 4068 49DA.tmp 4184 4A38.tmp 1260 4A96.tmp 1048 4AF3.tmp 3856 4B41.tmp 2644 4B9F.tmp 4520 4BED.tmp 3008 4C3B.tmp 2100 4C8A.tmp 1496 4CE7.tmp 1640 4D35.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2460 1968 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 88 PID 1968 wrote to memory of 2460 1968 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 88 PID 1968 wrote to memory of 2460 1968 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 88 PID 2460 wrote to memory of 2052 2460 350A.tmp 89 PID 2460 wrote to memory of 2052 2460 350A.tmp 89 PID 2460 wrote to memory of 2052 2460 350A.tmp 89 PID 2052 wrote to memory of 1976 2052 3587.tmp 90 PID 2052 wrote to memory of 1976 2052 3587.tmp 90 PID 2052 wrote to memory of 1976 2052 3587.tmp 90 PID 1976 wrote to memory of 3232 1976 35F4.tmp 91 PID 1976 wrote to memory of 3232 1976 35F4.tmp 91 PID 1976 wrote to memory of 3232 1976 35F4.tmp 91 PID 3232 wrote to memory of 312 3232 3662.tmp 93 PID 3232 wrote to memory of 312 3232 3662.tmp 93 PID 3232 wrote to memory of 312 3232 3662.tmp 93 PID 312 wrote to memory of 5112 312 36BF.tmp 95 PID 312 wrote to memory of 5112 312 36BF.tmp 95 PID 312 wrote to memory of 5112 312 36BF.tmp 95 PID 5112 wrote to memory of 4656 5112 373C.tmp 97 PID 5112 wrote to memory of 4656 5112 373C.tmp 97 PID 5112 wrote to memory of 4656 5112 373C.tmp 97 PID 4656 wrote to memory of 3488 4656 378B.tmp 98 PID 4656 wrote to memory of 3488 4656 378B.tmp 98 PID 4656 wrote to memory of 3488 4656 378B.tmp 98 PID 3488 wrote to memory of 1252 3488 37E8.tmp 99 PID 3488 wrote to memory of 1252 3488 37E8.tmp 99 PID 3488 wrote to memory of 1252 3488 37E8.tmp 99 PID 1252 wrote to memory of 2504 1252 3856.tmp 100 PID 1252 wrote to memory of 2504 1252 3856.tmp 100 PID 1252 wrote to memory of 2504 1252 3856.tmp 100 PID 2504 wrote to memory of 3580 2504 38A4.tmp 101 PID 2504 wrote to memory of 3580 2504 38A4.tmp 101 PID 2504 wrote to memory of 3580 2504 38A4.tmp 101 PID 3580 wrote to memory of 2520 3580 3921.tmp 102 PID 3580 wrote to memory of 2520 3580 3921.tmp 102 PID 3580 wrote to memory of 2520 3580 3921.tmp 102 PID 2520 wrote to memory of 4892 2520 399E.tmp 103 PID 2520 wrote to memory of 4892 2520 399E.tmp 103 PID 2520 wrote to memory of 4892 2520 399E.tmp 103 PID 4892 wrote to memory of 4664 4892 3A0B.tmp 104 PID 4892 wrote to memory of 4664 4892 3A0B.tmp 104 PID 4892 wrote to memory of 4664 4892 3A0B.tmp 104 PID 4664 wrote to memory of 1220 4664 3A69.tmp 105 PID 4664 wrote to memory of 1220 4664 3A69.tmp 105 PID 4664 wrote to memory of 1220 4664 3A69.tmp 105 PID 1220 wrote to memory of 1844 1220 3AD6.tmp 106 PID 1220 wrote to memory of 1844 1220 3AD6.tmp 106 PID 1220 wrote to memory of 1844 1220 3AD6.tmp 106 PID 1844 wrote to memory of 4064 1844 3B44.tmp 107 PID 1844 wrote to memory of 4064 1844 3B44.tmp 107 PID 1844 wrote to memory of 4064 1844 3B44.tmp 107 PID 4064 wrote to memory of 3516 4064 3BC1.tmp 108 PID 4064 wrote to memory of 3516 4064 3BC1.tmp 108 PID 4064 wrote to memory of 3516 4064 3BC1.tmp 108 PID 3516 wrote to memory of 216 3516 3C2E.tmp 109 PID 3516 wrote to memory of 216 3516 3C2E.tmp 109 PID 3516 wrote to memory of 216 3516 3C2E.tmp 109 PID 216 wrote to memory of 2040 216 3CCA.tmp 110 PID 216 wrote to memory of 2040 216 3CCA.tmp 110 PID 216 wrote to memory of 2040 216 3CCA.tmp 110 PID 2040 wrote to memory of 4520 2040 3D28.tmp 111 PID 2040 wrote to memory of 4520 2040 3D28.tmp 111 PID 2040 wrote to memory of 4520 2040 3D28.tmp 111 PID 4520 wrote to memory of 2216 4520 3DA5.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"23⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"24⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"25⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"26⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"27⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"28⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"29⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"30⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"31⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"32⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"33⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"34⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"35⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"36⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"37⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"38⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"39⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"40⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"41⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"42⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"43⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"44⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"45⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"46⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"47⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"48⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"49⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"50⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"51⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"52⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"53⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"54⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"55⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"56⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"57⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"58⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"59⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"60⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"61⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"62⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"63⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"64⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"65⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"66⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"67⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"68⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"69⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"70⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"71⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"72⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"73⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"74⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"75⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"76⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"77⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"78⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"79⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"80⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"82⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"83⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"84⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"85⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"86⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"87⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"88⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"89⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"90⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"91⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"92⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"93⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"94⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"95⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"96⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"97⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"98⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"99⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"100⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"101⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"102⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"103⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"104⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"105⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"106⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"107⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"108⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"109⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"110⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"111⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"112⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"113⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"114⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"115⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"116⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"117⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"119⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"120⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"121⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-