Analysis
-
max time kernel
133s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
-
Size
487KB
-
MD5
0cdf896a384a861e2d5be9861b20955a
-
SHA1
83b8edf83d1a49c7528bb515035e85048ce8e437
-
SHA256
335d1d42a3eb71b887da9b61cd57920689685f54c3567d799da4387857c01c30
-
SHA512
0902ab771b49d1881a2335efb1b9acbc46c54df50089001c2f8e730f3299b8f0da886853bdebf5ea11e9c97850336b3455d88beb1776b0f8b999f6ca9f449bce
-
SSDEEP
12288:yU5rCOTeiNHvzTZIihMGyLcP89Unt9SYXSCqPFikYp8JbZ:yUQOJNHvxNyc5tDXS5fCEb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1456 19EC.tmp 3660 1B53.tmp 1156 1BFF.tmp 2168 1CBA.tmp 1436 1D76.tmp 2324 1E41.tmp 3900 1F2B.tmp 1296 1FE7.tmp 2648 2083.tmp 3852 216E.tmp 4388 220A.tmp 4576 22D5.tmp 2500 25A4.tmp 4052 273A.tmp 2644 2863.tmp 2716 292E.tmp 716 29F9.tmp 1972 2A95.tmp 3960 2C89.tmp 3536 2D93.tmp 4196 2EEB.tmp 2376 2FD5.tmp 532 3081.tmp 380 317B.tmp 4620 3246.tmp 4324 3311.tmp 2100 3488.tmp 3696 3573.tmp 4464 366D.tmp 4996 3795.tmp 2892 396A.tmp 2548 3A26.tmp 4204 3AB2.tmp 4832 3B5E.tmp 4648 3C0A.tmp 3660 3C87.tmp 1156 3D33.tmp 4920 3DC0.tmp 1444 3E7B.tmp 456 3FB4.tmp 828 4050.tmp 1424 4179.tmp 3148 43CA.tmp 2532 44D4.tmp 1480 4590.tmp 4232 461C.tmp 2864 46D8.tmp 4576 4793.tmp 3688 4820.tmp 3648 488D.tmp 3052 4939.tmp 4100 49B6.tmp 2152 4A91.tmp 1968 4B5C.tmp 3844 4C08.tmp 3336 4CF2.tmp 396 4D6F.tmp 1288 4E3A.tmp 3524 4F15.tmp 972 4FD1.tmp 4364 507C.tmp 4244 5109.tmp 3692 5196.tmp 4884 5232.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 1456 4832 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 94 PID 4832 wrote to memory of 1456 4832 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 94 PID 4832 wrote to memory of 1456 4832 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 94 PID 1456 wrote to memory of 3660 1456 19EC.tmp 95 PID 1456 wrote to memory of 3660 1456 19EC.tmp 95 PID 1456 wrote to memory of 3660 1456 19EC.tmp 95 PID 3660 wrote to memory of 1156 3660 1B53.tmp 96 PID 3660 wrote to memory of 1156 3660 1B53.tmp 96 PID 3660 wrote to memory of 1156 3660 1B53.tmp 96 PID 1156 wrote to memory of 2168 1156 1BFF.tmp 97 PID 1156 wrote to memory of 2168 1156 1BFF.tmp 97 PID 1156 wrote to memory of 2168 1156 1BFF.tmp 97 PID 2168 wrote to memory of 1436 2168 1CBA.tmp 98 PID 2168 wrote to memory of 1436 2168 1CBA.tmp 98 PID 2168 wrote to memory of 1436 2168 1CBA.tmp 98 PID 1436 wrote to memory of 2324 1436 1D76.tmp 99 PID 1436 wrote to memory of 2324 1436 1D76.tmp 99 PID 1436 wrote to memory of 2324 1436 1D76.tmp 99 PID 2324 wrote to memory of 3900 2324 1E41.tmp 100 PID 2324 wrote to memory of 3900 2324 1E41.tmp 100 PID 2324 wrote to memory of 3900 2324 1E41.tmp 100 PID 3900 wrote to memory of 1296 3900 1F2B.tmp 101 PID 3900 wrote to memory of 1296 3900 1F2B.tmp 101 PID 3900 wrote to memory of 1296 3900 1F2B.tmp 101 PID 1296 wrote to memory of 2648 1296 1FE7.tmp 102 PID 1296 wrote to memory of 2648 1296 1FE7.tmp 102 PID 1296 wrote to memory of 2648 1296 1FE7.tmp 102 PID 2648 wrote to memory of 3852 2648 2083.tmp 103 PID 2648 wrote to memory of 3852 2648 2083.tmp 103 PID 2648 wrote to memory of 3852 2648 2083.tmp 103 PID 3852 wrote to memory of 4388 3852 216E.tmp 104 PID 3852 wrote to memory of 4388 3852 216E.tmp 104 PID 3852 wrote to memory of 4388 3852 216E.tmp 104 PID 4388 wrote to memory of 4576 4388 220A.tmp 105 PID 4388 wrote to memory of 4576 4388 220A.tmp 105 PID 4388 wrote to memory of 4576 4388 220A.tmp 105 PID 4576 wrote to memory of 2500 4576 22D5.tmp 106 PID 4576 wrote to memory of 2500 4576 22D5.tmp 106 PID 4576 wrote to memory of 2500 4576 22D5.tmp 106 PID 2500 wrote to memory of 4052 2500 25A4.tmp 107 PID 2500 wrote to memory of 4052 2500 25A4.tmp 107 PID 2500 wrote to memory of 4052 2500 25A4.tmp 107 PID 4052 wrote to memory of 2644 4052 273A.tmp 108 PID 4052 wrote to memory of 2644 4052 273A.tmp 108 PID 4052 wrote to memory of 2644 4052 273A.tmp 108 PID 2644 wrote to memory of 2716 2644 2863.tmp 109 PID 2644 wrote to memory of 2716 2644 2863.tmp 109 PID 2644 wrote to memory of 2716 2644 2863.tmp 109 PID 2716 wrote to memory of 716 2716 292E.tmp 110 PID 2716 wrote to memory of 716 2716 292E.tmp 110 PID 2716 wrote to memory of 716 2716 292E.tmp 110 PID 716 wrote to memory of 1972 716 29F9.tmp 111 PID 716 wrote to memory of 1972 716 29F9.tmp 111 PID 716 wrote to memory of 1972 716 29F9.tmp 111 PID 1972 wrote to memory of 3960 1972 2A95.tmp 112 PID 1972 wrote to memory of 3960 1972 2A95.tmp 112 PID 1972 wrote to memory of 3960 1972 2A95.tmp 112 PID 3960 wrote to memory of 3536 3960 2C89.tmp 113 PID 3960 wrote to memory of 3536 3960 2C89.tmp 113 PID 3960 wrote to memory of 3536 3960 2C89.tmp 113 PID 3536 wrote to memory of 4196 3536 2D93.tmp 114 PID 3536 wrote to memory of 4196 3536 2D93.tmp 114 PID 3536 wrote to memory of 4196 3536 2D93.tmp 114 PID 4196 wrote to memory of 2376 4196 2EEB.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"23⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"24⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"25⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"26⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"27⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"28⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"29⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"30⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"31⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"32⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"33⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"34⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"35⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"36⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"37⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"38⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"39⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"40⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"41⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"42⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"43⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"44⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"45⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"46⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"47⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"48⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"49⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"50⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"51⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"52⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"53⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"54⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"55⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"56⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"57⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"58⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"59⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"60⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"61⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"62⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"63⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"64⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"65⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"66⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"67⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"69⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"70⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"71⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"72⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"73⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"74⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"75⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"76⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"77⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"78⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"79⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"80⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"81⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"82⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"83⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"84⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"85⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"86⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"87⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"88⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"89⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"90⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"91⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"92⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"93⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"94⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"95⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"96⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"97⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"98⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"99⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"100⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"101⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"102⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"103⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"104⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"105⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"106⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"107⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"108⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"109⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"110⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"111⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"112⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"113⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"114⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"115⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"116⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"117⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"118⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"119⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"120⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"121⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"122⤵PID:3536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-