Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 02:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe
-
Size
486KB
-
MD5
cf0da86958b305a1fcb9599cd6a1518a
-
SHA1
07575039240be23621e6bec789bd96fbff6583ac
-
SHA256
1865639c414fc697e902b5180b1e09c944e4c01c8b514d6567a64046970404e8
-
SHA512
dece4f2f29bda31fec130eccc53fd36c32b7a34b200d2575781b1f891cead68362536ae2b44572fee2d819099533c17b5915b446f75916fcc0a34b3907049592
-
SSDEEP
12288:UU5rCOTeiDxsivitwRcyUum5UcseWiZ0GNZ:UUQOJDxsiqt4D7mSclKGN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4824 378B.tmp 996 37E8.tmp 2604 3856.tmp 976 38B3.tmp 1336 3902.tmp 2140 3950.tmp 4092 399E.tmp 1736 39EC.tmp 1660 3A3A.tmp 1568 3A88.tmp 3896 3AD6.tmp 4408 3B24.tmp 4840 3B73.tmp 4880 3BC1.tmp 2500 3BFF.tmp 3528 3C4D.tmp 844 3C8C.tmp 3032 3CDA.tmp 1108 3D38.tmp 4032 3D86.tmp 4584 3DD4.tmp 748 3E22.tmp 4676 3E61.tmp 2404 3EAF.tmp 3764 3F0C.tmp 940 3F5B.tmp 4352 3FB8.tmp 1792 4006.tmp 2284 4074.tmp 3596 40E1.tmp 4688 412F.tmp 2548 418D.tmp 4768 41DB.tmp 3324 4229.tmp 264 4277.tmp 396 42C6.tmp 3200 4304.tmp 1816 4352.tmp 2248 43A0.tmp 4436 43EE.tmp 696 442D.tmp 4464 447B.tmp 5024 44C9.tmp 2492 4517.tmp 4824 4556.tmp 4892 4594.tmp 4300 45E2.tmp 1676 4631.tmp 2632 466F.tmp 2604 46BD.tmp 4052 470B.tmp 1692 4759.tmp 2784 47A8.tmp 4104 47F6.tmp 1972 4844.tmp 2464 4892.tmp 4092 48E0.tmp 4996 492E.tmp 4268 497C.tmp 4140 49CA.tmp 4232 4A19.tmp 3056 4A67.tmp 916 4AB5.tmp 4520 4AF3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4824 2972 2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe 85 PID 2972 wrote to memory of 4824 2972 2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe 85 PID 2972 wrote to memory of 4824 2972 2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe 85 PID 4824 wrote to memory of 996 4824 378B.tmp 86 PID 4824 wrote to memory of 996 4824 378B.tmp 86 PID 4824 wrote to memory of 996 4824 378B.tmp 86 PID 996 wrote to memory of 2604 996 37E8.tmp 88 PID 996 wrote to memory of 2604 996 37E8.tmp 88 PID 996 wrote to memory of 2604 996 37E8.tmp 88 PID 2604 wrote to memory of 976 2604 3856.tmp 90 PID 2604 wrote to memory of 976 2604 3856.tmp 90 PID 2604 wrote to memory of 976 2604 3856.tmp 90 PID 976 wrote to memory of 1336 976 38B3.tmp 92 PID 976 wrote to memory of 1336 976 38B3.tmp 92 PID 976 wrote to memory of 1336 976 38B3.tmp 92 PID 1336 wrote to memory of 2140 1336 3902.tmp 93 PID 1336 wrote to memory of 2140 1336 3902.tmp 93 PID 1336 wrote to memory of 2140 1336 3902.tmp 93 PID 2140 wrote to memory of 4092 2140 3950.tmp 144 PID 2140 wrote to memory of 4092 2140 3950.tmp 144 PID 2140 wrote to memory of 4092 2140 3950.tmp 144 PID 4092 wrote to memory of 1736 4092 399E.tmp 95 PID 4092 wrote to memory of 1736 4092 399E.tmp 95 PID 4092 wrote to memory of 1736 4092 399E.tmp 95 PID 1736 wrote to memory of 1660 1736 39EC.tmp 96 PID 1736 wrote to memory of 1660 1736 39EC.tmp 96 PID 1736 wrote to memory of 1660 1736 39EC.tmp 96 PID 1660 wrote to memory of 1568 1660 3A3A.tmp 97 PID 1660 wrote to memory of 1568 1660 3A3A.tmp 97 PID 1660 wrote to memory of 1568 1660 3A3A.tmp 97 PID 1568 wrote to memory of 3896 1568 3A88.tmp 98 PID 1568 wrote to memory of 3896 1568 3A88.tmp 98 PID 1568 wrote to memory of 3896 1568 3A88.tmp 98 PID 3896 wrote to memory of 4408 3896 3AD6.tmp 99 PID 3896 wrote to memory of 4408 3896 3AD6.tmp 99 PID 3896 wrote to memory of 4408 3896 3AD6.tmp 99 PID 4408 wrote to memory of 4840 4408 3B24.tmp 100 PID 4408 wrote to memory of 4840 4408 3B24.tmp 100 PID 4408 wrote to memory of 4840 4408 3B24.tmp 100 PID 4840 wrote to memory of 4880 4840 3B73.tmp 101 PID 4840 wrote to memory of 4880 4840 3B73.tmp 101 PID 4840 wrote to memory of 4880 4840 3B73.tmp 101 PID 4880 wrote to memory of 2500 4880 3BC1.tmp 102 PID 4880 wrote to memory of 2500 4880 3BC1.tmp 102 PID 4880 wrote to memory of 2500 4880 3BC1.tmp 102 PID 2500 wrote to memory of 3528 2500 3BFF.tmp 103 PID 2500 wrote to memory of 3528 2500 3BFF.tmp 103 PID 2500 wrote to memory of 3528 2500 3BFF.tmp 103 PID 3528 wrote to memory of 844 3528 3C4D.tmp 104 PID 3528 wrote to memory of 844 3528 3C4D.tmp 104 PID 3528 wrote to memory of 844 3528 3C4D.tmp 104 PID 844 wrote to memory of 3032 844 3C8C.tmp 159 PID 844 wrote to memory of 3032 844 3C8C.tmp 159 PID 844 wrote to memory of 3032 844 3C8C.tmp 159 PID 3032 wrote to memory of 1108 3032 3CDA.tmp 106 PID 3032 wrote to memory of 1108 3032 3CDA.tmp 106 PID 3032 wrote to memory of 1108 3032 3CDA.tmp 106 PID 1108 wrote to memory of 4032 1108 3D38.tmp 107 PID 1108 wrote to memory of 4032 1108 3D38.tmp 107 PID 1108 wrote to memory of 4032 1108 3D38.tmp 107 PID 4032 wrote to memory of 4584 4032 3D86.tmp 108 PID 4032 wrote to memory of 4584 4032 3D86.tmp 108 PID 4032 wrote to memory of 4584 4032 3D86.tmp 108 PID 4584 wrote to memory of 748 4584 3DD4.tmp 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_cf0da86958b305a1fcb9599cd6a1518a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"23⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"24⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"25⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"26⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"27⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"28⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"29⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"30⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"31⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"32⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"33⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"34⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"35⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"36⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"37⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"38⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"39⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"40⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"41⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"42⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"43⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"44⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"45⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"46⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"47⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"48⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"49⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"50⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"51⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"52⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"53⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"54⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"55⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"56⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"57⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"58⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"59⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"60⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"61⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"62⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"63⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"64⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"65⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"66⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"67⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"68⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"69⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"70⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"71⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"72⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"73⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"74⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"75⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"76⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"77⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"78⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"80⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"81⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"82⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"83⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"84⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"85⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"86⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"87⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"88⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"89⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"90⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"91⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"92⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"93⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"94⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"95⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"96⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"97⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"98⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"99⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"100⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"101⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"102⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"103⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"104⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"105⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"106⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"107⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"108⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"109⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"110⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"111⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"112⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"113⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"114⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"115⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"116⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"117⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"118⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"119⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"120⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"121⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"122⤵PID:640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-