Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe
-
Size
486KB
-
MD5
312277df2296e9308095c82ae18a1def
-
SHA1
c0013a6a4e8bf9b7b627d71b138297c1854d7b0c
-
SHA256
e024d9367971aa7b0b706c700b16bc243dfe3a678634bdd39a5e37cd7df101f4
-
SHA512
40c3530738c6ed4408923928b5520452c760c2d2b048f7965684d1bde1803d6d97e40fe1c9eeb72309a33bb407b8610450c87e603a9599e8e65456da3899067c
-
SSDEEP
12288:UU5rCOTeiDfO2sqLdKNViImfkV1ZJNqn98xQZrb0NZ:UUQOJDfOQcmMJQ95aN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2176 3D67.tmp 3672 3DD4.tmp 3200 3E22.tmp 4080 3E8F.tmp 2436 3EFD.tmp 4764 3F5B.tmp 1620 3FC8.tmp 412 4035.tmp 2104 40B2.tmp 3492 412F.tmp 2772 419D.tmp 3144 41EB.tmp 1692 4239.tmp 4436 4287.tmp 4112 42E5.tmp 316 4362.tmp 2580 43CF.tmp 4456 442D.tmp 840 449A.tmp 3680 4508.tmp 4496 4556.tmp 3692 45B4.tmp 1020 4621.tmp 3056 467F.tmp 4756 46CD.tmp 864 473A.tmp 2768 4798.tmp 4008 4805.tmp 844 4863.tmp 4312 48C1.tmp 3160 493E.tmp 3324 499C.tmp 3996 4A19.tmp 3288 4A76.tmp 3928 4AC4.tmp 1064 4B13.tmp 972 4B61.tmp 4800 4C0D.tmp 1988 4C5B.tmp 5088 4CA9.tmp 2436 4D07.tmp 4764 4D55.tmp 1400 4DA3.tmp 4024 4DF1.tmp 3552 4E3F.tmp 2896 4E8D.tmp 3332 4EDB.tmp 2104 4F29.tmp 4184 4F87.tmp 1104 4FD5.tmp 2772 5023.tmp 1108 5091.tmp 1704 50EF.tmp 2908 514C.tmp 3588 519A.tmp 4736 51E9.tmp 2200 5237.tmp 956 5285.tmp 2660 52D3.tmp 3600 5321.tmp 4984 538E.tmp 2016 53DD.tmp 4508 542B.tmp 4628 5479.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 2176 1564 2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe 90 PID 1564 wrote to memory of 2176 1564 2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe 90 PID 1564 wrote to memory of 2176 1564 2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe 90 PID 2176 wrote to memory of 3672 2176 3D67.tmp 91 PID 2176 wrote to memory of 3672 2176 3D67.tmp 91 PID 2176 wrote to memory of 3672 2176 3D67.tmp 91 PID 3672 wrote to memory of 3200 3672 3DD4.tmp 92 PID 3672 wrote to memory of 3200 3672 3DD4.tmp 92 PID 3672 wrote to memory of 3200 3672 3DD4.tmp 92 PID 3200 wrote to memory of 4080 3200 3E22.tmp 94 PID 3200 wrote to memory of 4080 3200 3E22.tmp 94 PID 3200 wrote to memory of 4080 3200 3E22.tmp 94 PID 4080 wrote to memory of 2436 4080 3E8F.tmp 95 PID 4080 wrote to memory of 2436 4080 3E8F.tmp 95 PID 4080 wrote to memory of 2436 4080 3E8F.tmp 95 PID 2436 wrote to memory of 4764 2436 3EFD.tmp 96 PID 2436 wrote to memory of 4764 2436 3EFD.tmp 96 PID 2436 wrote to memory of 4764 2436 3EFD.tmp 96 PID 4764 wrote to memory of 1620 4764 3F5B.tmp 99 PID 4764 wrote to memory of 1620 4764 3F5B.tmp 99 PID 4764 wrote to memory of 1620 4764 3F5B.tmp 99 PID 1620 wrote to memory of 412 1620 3FC8.tmp 101 PID 1620 wrote to memory of 412 1620 3FC8.tmp 101 PID 1620 wrote to memory of 412 1620 3FC8.tmp 101 PID 412 wrote to memory of 2104 412 4035.tmp 102 PID 412 wrote to memory of 2104 412 4035.tmp 102 PID 412 wrote to memory of 2104 412 4035.tmp 102 PID 2104 wrote to memory of 3492 2104 40B2.tmp 103 PID 2104 wrote to memory of 3492 2104 40B2.tmp 103 PID 2104 wrote to memory of 3492 2104 40B2.tmp 103 PID 3492 wrote to memory of 2772 3492 412F.tmp 104 PID 3492 wrote to memory of 2772 3492 412F.tmp 104 PID 3492 wrote to memory of 2772 3492 412F.tmp 104 PID 2772 wrote to memory of 3144 2772 419D.tmp 105 PID 2772 wrote to memory of 3144 2772 419D.tmp 105 PID 2772 wrote to memory of 3144 2772 419D.tmp 105 PID 3144 wrote to memory of 1692 3144 41EB.tmp 106 PID 3144 wrote to memory of 1692 3144 41EB.tmp 106 PID 3144 wrote to memory of 1692 3144 41EB.tmp 106 PID 1692 wrote to memory of 4436 1692 4239.tmp 107 PID 1692 wrote to memory of 4436 1692 4239.tmp 107 PID 1692 wrote to memory of 4436 1692 4239.tmp 107 PID 4436 wrote to memory of 4112 4436 4287.tmp 108 PID 4436 wrote to memory of 4112 4436 4287.tmp 108 PID 4436 wrote to memory of 4112 4436 4287.tmp 108 PID 4112 wrote to memory of 316 4112 42E5.tmp 109 PID 4112 wrote to memory of 316 4112 42E5.tmp 109 PID 4112 wrote to memory of 316 4112 42E5.tmp 109 PID 316 wrote to memory of 2580 316 4362.tmp 110 PID 316 wrote to memory of 2580 316 4362.tmp 110 PID 316 wrote to memory of 2580 316 4362.tmp 110 PID 2580 wrote to memory of 4456 2580 43CF.tmp 111 PID 2580 wrote to memory of 4456 2580 43CF.tmp 111 PID 2580 wrote to memory of 4456 2580 43CF.tmp 111 PID 4456 wrote to memory of 840 4456 442D.tmp 112 PID 4456 wrote to memory of 840 4456 442D.tmp 112 PID 4456 wrote to memory of 840 4456 442D.tmp 112 PID 840 wrote to memory of 3680 840 449A.tmp 113 PID 840 wrote to memory of 3680 840 449A.tmp 113 PID 840 wrote to memory of 3680 840 449A.tmp 113 PID 3680 wrote to memory of 4496 3680 4508.tmp 114 PID 3680 wrote to memory of 4496 3680 4508.tmp 114 PID 3680 wrote to memory of 4496 3680 4508.tmp 114 PID 4496 wrote to memory of 3692 4496 4556.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_312277df2296e9308095c82ae18a1def_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"23⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"24⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"25⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"26⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"27⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"28⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"29⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"30⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"31⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"32⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"33⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"34⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"35⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"36⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"37⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"38⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"39⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"40⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"41⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"42⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"43⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"45⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"46⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"47⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"48⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"49⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"50⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"51⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"52⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"53⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"54⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"55⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"56⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"57⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"58⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"59⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"60⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"61⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"62⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"63⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"64⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"65⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"66⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"67⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"68⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"69⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"70⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"71⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"72⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"73⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"75⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"76⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"77⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"78⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"79⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"80⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"81⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"82⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"83⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"84⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"85⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"86⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"88⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"89⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"90⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"91⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"93⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"94⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"95⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"96⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"97⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"98⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"99⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"100⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"101⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"102⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"103⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"104⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"105⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"106⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"107⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"108⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"109⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"110⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"111⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"112⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"113⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"114⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"115⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"116⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"117⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"118⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"119⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"120⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"121⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"122⤵PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-