Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
-
Size
488KB
-
MD5
cc991ae509fb05f7bb7984cb8e1c1e41
-
SHA1
20725be2ad6f2c27126b341b286622773299f418
-
SHA256
b00810a8f148047041835b9303e99450c8cdffaae253d9c713399ed6b03b75b4
-
SHA512
ef08fbb299091b343c5abd27a760e9bb9cc2da24974bd25047164e04708fbf28dd53263a101b595d843a6d6aba7f09c8eaf60adaefecfcd897a03354eae9041e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7iwQhNT32G60vjZMmiOKxxvDGhT0OSZBw43gj:/U5rCOTeiDiXR56qKXOOxrCHPBNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4956 2EB1.tmp 4868 2F1E.tmp 5044 2F7C.tmp 1380 2FDA.tmp 2996 3038.tmp 2720 3095.tmp 3120 30E3.tmp 2084 3132.tmp 3768 3180.tmp 1648 31CE.tmp 4088 321C.tmp 2992 327A.tmp 3028 32D7.tmp 944 3326.tmp 3004 3383.tmp 3752 33F1.tmp 3548 345E.tmp 4208 34AC.tmp 2316 350A.tmp 4628 3558.tmp 876 35B6.tmp 4348 3604.tmp 3928 3652.tmp 1392 36A0.tmp 1840 36FE.tmp 4424 375C.tmp 4916 37B9.tmp 3184 3827.tmp 1508 3894.tmp 3712 38E2.tmp 3940 3950.tmp 1464 39BD.tmp 4032 3A0B.tmp 3420 3A59.tmp 2220 3AA7.tmp 1952 3AF6.tmp 712 3B44.tmp 4312 3BA1.tmp 1476 3BFF.tmp 3416 3C5D.tmp 2384 3CBB.tmp 4608 3D09.tmp 5008 3D67.tmp 1960 3DC4.tmp 3652 3E12.tmp 1272 3E70.tmp 3560 3EBE.tmp 1388 3F1C.tmp 2996 3F7A.tmp 4940 3FD8.tmp 4448 4026.tmp 3044 4083.tmp 3176 40D2.tmp 3528 412F.tmp 3968 418D.tmp 3976 41EB.tmp 4080 4249.tmp 4720 4297.tmp 3088 42E5.tmp 576 4333.tmp 4268 4381.tmp 3216 43CF.tmp 4176 441D.tmp 5048 446B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 4956 3984 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 86 PID 3984 wrote to memory of 4956 3984 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 86 PID 3984 wrote to memory of 4956 3984 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 86 PID 4956 wrote to memory of 4868 4956 2EB1.tmp 88 PID 4956 wrote to memory of 4868 4956 2EB1.tmp 88 PID 4956 wrote to memory of 4868 4956 2EB1.tmp 88 PID 4868 wrote to memory of 5044 4868 2F1E.tmp 89 PID 4868 wrote to memory of 5044 4868 2F1E.tmp 89 PID 4868 wrote to memory of 5044 4868 2F1E.tmp 89 PID 5044 wrote to memory of 1380 5044 2F7C.tmp 91 PID 5044 wrote to memory of 1380 5044 2F7C.tmp 91 PID 5044 wrote to memory of 1380 5044 2F7C.tmp 91 PID 1380 wrote to memory of 2996 1380 2FDA.tmp 92 PID 1380 wrote to memory of 2996 1380 2FDA.tmp 92 PID 1380 wrote to memory of 2996 1380 2FDA.tmp 92 PID 2996 wrote to memory of 2720 2996 3038.tmp 93 PID 2996 wrote to memory of 2720 2996 3038.tmp 93 PID 2996 wrote to memory of 2720 2996 3038.tmp 93 PID 2720 wrote to memory of 3120 2720 3095.tmp 94 PID 2720 wrote to memory of 3120 2720 3095.tmp 94 PID 2720 wrote to memory of 3120 2720 3095.tmp 94 PID 3120 wrote to memory of 2084 3120 30E3.tmp 95 PID 3120 wrote to memory of 2084 3120 30E3.tmp 95 PID 3120 wrote to memory of 2084 3120 30E3.tmp 95 PID 2084 wrote to memory of 3768 2084 3132.tmp 96 PID 2084 wrote to memory of 3768 2084 3132.tmp 96 PID 2084 wrote to memory of 3768 2084 3132.tmp 96 PID 3768 wrote to memory of 1648 3768 3180.tmp 97 PID 3768 wrote to memory of 1648 3768 3180.tmp 97 PID 3768 wrote to memory of 1648 3768 3180.tmp 97 PID 1648 wrote to memory of 4088 1648 31CE.tmp 98 PID 1648 wrote to memory of 4088 1648 31CE.tmp 98 PID 1648 wrote to memory of 4088 1648 31CE.tmp 98 PID 4088 wrote to memory of 2992 4088 321C.tmp 99 PID 4088 wrote to memory of 2992 4088 321C.tmp 99 PID 4088 wrote to memory of 2992 4088 321C.tmp 99 PID 2992 wrote to memory of 3028 2992 327A.tmp 100 PID 2992 wrote to memory of 3028 2992 327A.tmp 100 PID 2992 wrote to memory of 3028 2992 327A.tmp 100 PID 3028 wrote to memory of 944 3028 32D7.tmp 101 PID 3028 wrote to memory of 944 3028 32D7.tmp 101 PID 3028 wrote to memory of 944 3028 32D7.tmp 101 PID 944 wrote to memory of 3004 944 3326.tmp 102 PID 944 wrote to memory of 3004 944 3326.tmp 102 PID 944 wrote to memory of 3004 944 3326.tmp 102 PID 3004 wrote to memory of 3752 3004 3383.tmp 103 PID 3004 wrote to memory of 3752 3004 3383.tmp 103 PID 3004 wrote to memory of 3752 3004 3383.tmp 103 PID 3752 wrote to memory of 3548 3752 33F1.tmp 104 PID 3752 wrote to memory of 3548 3752 33F1.tmp 104 PID 3752 wrote to memory of 3548 3752 33F1.tmp 104 PID 3548 wrote to memory of 4208 3548 345E.tmp 105 PID 3548 wrote to memory of 4208 3548 345E.tmp 105 PID 3548 wrote to memory of 4208 3548 345E.tmp 105 PID 4208 wrote to memory of 2316 4208 34AC.tmp 106 PID 4208 wrote to memory of 2316 4208 34AC.tmp 106 PID 4208 wrote to memory of 2316 4208 34AC.tmp 106 PID 2316 wrote to memory of 4628 2316 350A.tmp 107 PID 2316 wrote to memory of 4628 2316 350A.tmp 107 PID 2316 wrote to memory of 4628 2316 350A.tmp 107 PID 4628 wrote to memory of 876 4628 3558.tmp 108 PID 4628 wrote to memory of 876 4628 3558.tmp 108 PID 4628 wrote to memory of 876 4628 3558.tmp 108 PID 876 wrote to memory of 4348 876 35B6.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3095.tmp"C:\Users\Admin\AppData\Local\Temp\3095.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\31CE.tmp"C:\Users\Admin\AppData\Local\Temp\31CE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"23⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"24⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"25⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"26⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"27⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"28⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"29⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"30⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"31⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"32⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"33⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"34⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"35⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"36⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"37⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"38⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"39⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"40⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"41⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"42⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"43⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"44⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"45⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"46⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"47⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"48⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"49⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"50⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"51⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"52⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"53⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"54⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"55⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"56⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"57⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"58⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"59⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"60⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"61⤵
- Executes dropped EXE
PID:576 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"62⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"63⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"64⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"65⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"66⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"67⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"68⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"69⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"70⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"72⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"73⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"74⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"75⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"76⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"78⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"79⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"80⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"81⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"82⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"83⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"85⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"87⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"88⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"89⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"90⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"91⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"92⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"93⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"94⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"95⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"96⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"97⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"98⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"99⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"100⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"101⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"102⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"103⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"104⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"105⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"106⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"107⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"108⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"109⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"110⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"111⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"112⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"113⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"114⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"115⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"116⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"117⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"118⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"119⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"121⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"122⤵PID:4220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-