Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 20:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe
-
Size
487KB
-
MD5
9779464d2dd35aca2190c386ffa2a578
-
SHA1
9b01095b153985d64e5c2576e2f415b6bfe0bb99
-
SHA256
1d85e87064636b70e0613da00bcf3097777c29d8507faf09fc371455ecefd718
-
SHA512
24a8b5cd58e05e965c1ce35b07067c142a8b309d3420aa3e90f05226f5c44f1cf277ca67151c5760612d10a4fdd33acf811b3a2c082ee8b32e5e034ed8ba5e81
-
SSDEEP
12288:yU5rCOTeiNkDrdRJvBOWJ43tKBMLIMnJ/QbZ:yUQOJN8JvMWJ43YMnJob
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1476 3306.tmp 4872 3364.tmp 2728 33D1.tmp 4468 342F.tmp 3268 349D.tmp 2580 351A.tmp 4516 3587.tmp 4316 3604.tmp 880 3662.tmp 336 36B0.tmp 3000 36FE.tmp 2508 374C.tmp 1764 379A.tmp 4892 3808.tmp 2732 3856.tmp 2476 38B3.tmp 1256 3921.tmp 404 396F.tmp 2932 39DC.tmp 1672 3A4A.tmp 2392 3A98.tmp 980 3AF6.tmp 1696 3B53.tmp 4320 3BC1.tmp 3340 3C2E.tmp 2124 3C7C.tmp 4792 3CDA.tmp 2376 3D47.tmp 2480 3DB5.tmp 3736 3E03.tmp 956 3E61.tmp 464 3ECE.tmp 1488 3F4B.tmp 428 3F99.tmp 3508 3FF7.tmp 4508 4045.tmp 4536 4093.tmp 4372 40E1.tmp 3896 413F.tmp 2892 418D.tmp 1268 41EB.tmp 2728 4249.tmp 4388 4297.tmp 3548 42E5.tmp 1556 4333.tmp 432 4381.tmp 2580 43DF.tmp 4644 443D.tmp 184 448B.tmp 3152 44D9.tmp 1892 4527.tmp 4996 4585.tmp 2656 45D3.tmp 1604 4650.tmp 4608 469E.tmp 4412 46FC.tmp 1124 474A.tmp 896 47A8.tmp 1372 47F6.tmp 1552 4844.tmp 4916 4892.tmp 3924 48E0.tmp 1048 492E.tmp 4168 497C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1476 1464 2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe 88 PID 1464 wrote to memory of 1476 1464 2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe 88 PID 1464 wrote to memory of 1476 1464 2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe 88 PID 1476 wrote to memory of 4872 1476 3306.tmp 89 PID 1476 wrote to memory of 4872 1476 3306.tmp 89 PID 1476 wrote to memory of 4872 1476 3306.tmp 89 PID 4872 wrote to memory of 2728 4872 3364.tmp 90 PID 4872 wrote to memory of 2728 4872 3364.tmp 90 PID 4872 wrote to memory of 2728 4872 3364.tmp 90 PID 2728 wrote to memory of 4468 2728 33D1.tmp 91 PID 2728 wrote to memory of 4468 2728 33D1.tmp 91 PID 2728 wrote to memory of 4468 2728 33D1.tmp 91 PID 4468 wrote to memory of 3268 4468 342F.tmp 93 PID 4468 wrote to memory of 3268 4468 342F.tmp 93 PID 4468 wrote to memory of 3268 4468 342F.tmp 93 PID 3268 wrote to memory of 2580 3268 349D.tmp 96 PID 3268 wrote to memory of 2580 3268 349D.tmp 96 PID 3268 wrote to memory of 2580 3268 349D.tmp 96 PID 2580 wrote to memory of 4516 2580 351A.tmp 97 PID 2580 wrote to memory of 4516 2580 351A.tmp 97 PID 2580 wrote to memory of 4516 2580 351A.tmp 97 PID 4516 wrote to memory of 4316 4516 3587.tmp 98 PID 4516 wrote to memory of 4316 4516 3587.tmp 98 PID 4516 wrote to memory of 4316 4516 3587.tmp 98 PID 4316 wrote to memory of 880 4316 3604.tmp 99 PID 4316 wrote to memory of 880 4316 3604.tmp 99 PID 4316 wrote to memory of 880 4316 3604.tmp 99 PID 880 wrote to memory of 336 880 3662.tmp 100 PID 880 wrote to memory of 336 880 3662.tmp 100 PID 880 wrote to memory of 336 880 3662.tmp 100 PID 336 wrote to memory of 3000 336 36B0.tmp 101 PID 336 wrote to memory of 3000 336 36B0.tmp 101 PID 336 wrote to memory of 3000 336 36B0.tmp 101 PID 3000 wrote to memory of 2508 3000 36FE.tmp 102 PID 3000 wrote to memory of 2508 3000 36FE.tmp 102 PID 3000 wrote to memory of 2508 3000 36FE.tmp 102 PID 2508 wrote to memory of 1764 2508 374C.tmp 103 PID 2508 wrote to memory of 1764 2508 374C.tmp 103 PID 2508 wrote to memory of 1764 2508 374C.tmp 103 PID 1764 wrote to memory of 4892 1764 379A.tmp 104 PID 1764 wrote to memory of 4892 1764 379A.tmp 104 PID 1764 wrote to memory of 4892 1764 379A.tmp 104 PID 4892 wrote to memory of 2732 4892 3808.tmp 105 PID 4892 wrote to memory of 2732 4892 3808.tmp 105 PID 4892 wrote to memory of 2732 4892 3808.tmp 105 PID 2732 wrote to memory of 2476 2732 3856.tmp 106 PID 2732 wrote to memory of 2476 2732 3856.tmp 106 PID 2732 wrote to memory of 2476 2732 3856.tmp 106 PID 2476 wrote to memory of 1256 2476 38B3.tmp 107 PID 2476 wrote to memory of 1256 2476 38B3.tmp 107 PID 2476 wrote to memory of 1256 2476 38B3.tmp 107 PID 1256 wrote to memory of 404 1256 3921.tmp 108 PID 1256 wrote to memory of 404 1256 3921.tmp 108 PID 1256 wrote to memory of 404 1256 3921.tmp 108 PID 404 wrote to memory of 2932 404 396F.tmp 109 PID 404 wrote to memory of 2932 404 396F.tmp 109 PID 404 wrote to memory of 2932 404 396F.tmp 109 PID 2932 wrote to memory of 1672 2932 39DC.tmp 110 PID 2932 wrote to memory of 1672 2932 39DC.tmp 110 PID 2932 wrote to memory of 1672 2932 39DC.tmp 110 PID 1672 wrote to memory of 2392 1672 3A4A.tmp 111 PID 1672 wrote to memory of 2392 1672 3A4A.tmp 111 PID 1672 wrote to memory of 2392 1672 3A4A.tmp 111 PID 2392 wrote to memory of 980 2392 3A98.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_9779464d2dd35aca2190c386ffa2a578_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"23⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"24⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"25⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"26⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"27⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"28⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"29⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"30⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"31⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"32⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"33⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"34⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"35⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"36⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"37⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"38⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"39⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"40⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"41⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"42⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"43⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"44⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"45⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"46⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"47⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"48⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"49⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"50⤵
- Executes dropped EXE
PID:184 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"51⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"52⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"53⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"54⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"55⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"57⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"58⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"59⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"60⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"61⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"62⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"63⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"64⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"65⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"66⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"67⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"68⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"70⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"71⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"72⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"73⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"74⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"75⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"76⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"77⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"78⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"79⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"80⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"81⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"82⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"83⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"84⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"85⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"86⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"87⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"88⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"89⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"90⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"91⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"92⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"93⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"94⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"95⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"96⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"97⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"98⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"99⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"100⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"101⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"102⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"103⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"104⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"105⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"106⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"107⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"108⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"109⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"110⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"111⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"112⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"114⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"115⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"116⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"117⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"118⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"119⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"120⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"121⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"122⤵PID:4536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-