Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
-
Size
529KB
-
MD5
0fbeadb3d35d4128c14718bb0da13905
-
SHA1
c100703641712f8411b98027cfdccbe39fb11a84
-
SHA256
edf8b1fa22b6dd32ebbbbd0e31c1ea94de9cab2cbc2adfe9113059ce68c3e126
-
SHA512
d010e7cd68eef8143be35cde7b122fe88ca7e8a9af994c674471b4f4b0b7514ad4eeb3324b9fdc1c4e96afe34cb1c274e7079a961b548ce7dd1b17f00a692547
-
SSDEEP
12288:NU5rCOTeij3kMB9NgbpTGvc+bIEAiATZwlH4Hp:NUQOJj3PB9NapGNbIEATSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4716 3103.tmp 4052 3180.tmp 3596 31ED.tmp 3084 326A.tmp 4984 32D7.tmp 5208 3345.tmp 4224 3393.tmp 3332 33E1.tmp 1708 344E.tmp 1956 34BC.tmp 4904 350A.tmp 5176 3568.tmp 5116 35E5.tmp 5316 3662.tmp 3456 36BF.tmp 4392 373C.tmp 5276 378B.tmp 1476 37E8.tmp 2716 3856.tmp 4880 38A4.tmp 5484 3911.tmp 4316 395F.tmp 1964 39CD.tmp 5692 3A2A.tmp 5192 3AA7.tmp 5464 3AF6.tmp 5136 3B44.tmp 1028 3BB1.tmp 2012 3C0F.tmp 4520 3C7C.tmp 744 3CDA.tmp 3520 3D47.tmp 1340 3D95.tmp 5124 3DF3.tmp 3488 3E41.tmp 4192 3E8F.tmp 4864 3EDE.tmp 1448 3F2C.tmp 5828 3F7A.tmp 4692 3FD8.tmp 4728 4035.tmp 3592 4083.tmp 4952 40D2.tmp 3452 412F.tmp 1804 417D.tmp 1264 41CC.tmp 4656 421A.tmp 1684 4277.tmp 5644 42C6.tmp 2072 4323.tmp 2932 4381.tmp 5520 43DF.tmp 5612 442D.tmp 5168 448B.tmp 2688 44D9.tmp 2028 4527.tmp 1952 4585.tmp 2176 45E2.tmp 5540 4631.tmp 1084 467F.tmp 1796 46DC.tmp 2092 472B.tmp 3144 4788.tmp 1748 47D6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5348 wrote to memory of 4716 5348 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 82 PID 5348 wrote to memory of 4716 5348 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 82 PID 5348 wrote to memory of 4716 5348 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 82 PID 4716 wrote to memory of 4052 4716 3103.tmp 83 PID 4716 wrote to memory of 4052 4716 3103.tmp 83 PID 4716 wrote to memory of 4052 4716 3103.tmp 83 PID 4052 wrote to memory of 3596 4052 3180.tmp 84 PID 4052 wrote to memory of 3596 4052 3180.tmp 84 PID 4052 wrote to memory of 3596 4052 3180.tmp 84 PID 3596 wrote to memory of 3084 3596 31ED.tmp 85 PID 3596 wrote to memory of 3084 3596 31ED.tmp 85 PID 3596 wrote to memory of 3084 3596 31ED.tmp 85 PID 3084 wrote to memory of 4984 3084 326A.tmp 87 PID 3084 wrote to memory of 4984 3084 326A.tmp 87 PID 3084 wrote to memory of 4984 3084 326A.tmp 87 PID 4984 wrote to memory of 5208 4984 32D7.tmp 89 PID 4984 wrote to memory of 5208 4984 32D7.tmp 89 PID 4984 wrote to memory of 5208 4984 32D7.tmp 89 PID 5208 wrote to memory of 4224 5208 3345.tmp 91 PID 5208 wrote to memory of 4224 5208 3345.tmp 91 PID 5208 wrote to memory of 4224 5208 3345.tmp 91 PID 4224 wrote to memory of 3332 4224 3393.tmp 92 PID 4224 wrote to memory of 3332 4224 3393.tmp 92 PID 4224 wrote to memory of 3332 4224 3393.tmp 92 PID 3332 wrote to memory of 1708 3332 33E1.tmp 93 PID 3332 wrote to memory of 1708 3332 33E1.tmp 93 PID 3332 wrote to memory of 1708 3332 33E1.tmp 93 PID 1708 wrote to memory of 1956 1708 344E.tmp 94 PID 1708 wrote to memory of 1956 1708 344E.tmp 94 PID 1708 wrote to memory of 1956 1708 344E.tmp 94 PID 1956 wrote to memory of 4904 1956 34BC.tmp 95 PID 1956 wrote to memory of 4904 1956 34BC.tmp 95 PID 1956 wrote to memory of 4904 1956 34BC.tmp 95 PID 4904 wrote to memory of 5176 4904 350A.tmp 96 PID 4904 wrote to memory of 5176 4904 350A.tmp 96 PID 4904 wrote to memory of 5176 4904 350A.tmp 96 PID 5176 wrote to memory of 5116 5176 3568.tmp 97 PID 5176 wrote to memory of 5116 5176 3568.tmp 97 PID 5176 wrote to memory of 5116 5176 3568.tmp 97 PID 5116 wrote to memory of 5316 5116 35E5.tmp 98 PID 5116 wrote to memory of 5316 5116 35E5.tmp 98 PID 5116 wrote to memory of 5316 5116 35E5.tmp 98 PID 5316 wrote to memory of 3456 5316 3662.tmp 99 PID 5316 wrote to memory of 3456 5316 3662.tmp 99 PID 5316 wrote to memory of 3456 5316 3662.tmp 99 PID 3456 wrote to memory of 4392 3456 36BF.tmp 100 PID 3456 wrote to memory of 4392 3456 36BF.tmp 100 PID 3456 wrote to memory of 4392 3456 36BF.tmp 100 PID 4392 wrote to memory of 5276 4392 373C.tmp 101 PID 4392 wrote to memory of 5276 4392 373C.tmp 101 PID 4392 wrote to memory of 5276 4392 373C.tmp 101 PID 5276 wrote to memory of 1476 5276 378B.tmp 102 PID 5276 wrote to memory of 1476 5276 378B.tmp 102 PID 5276 wrote to memory of 1476 5276 378B.tmp 102 PID 1476 wrote to memory of 2716 1476 37E8.tmp 103 PID 1476 wrote to memory of 2716 1476 37E8.tmp 103 PID 1476 wrote to memory of 2716 1476 37E8.tmp 103 PID 2716 wrote to memory of 4880 2716 3856.tmp 104 PID 2716 wrote to memory of 4880 2716 3856.tmp 104 PID 2716 wrote to memory of 4880 2716 3856.tmp 104 PID 4880 wrote to memory of 5484 4880 38A4.tmp 105 PID 4880 wrote to memory of 5484 4880 38A4.tmp 105 PID 4880 wrote to memory of 5484 4880 38A4.tmp 105 PID 5484 wrote to memory of 4316 5484 3911.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\3103.tmp"C:\Users\Admin\AppData\Local\Temp\3103.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"23⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"24⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"25⤵
- Executes dropped EXE
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"26⤵
- Executes dropped EXE
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"27⤵
- Executes dropped EXE
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"28⤵
- Executes dropped EXE
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"29⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"30⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"31⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"32⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"33⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"34⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"35⤵
- Executes dropped EXE
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"36⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"37⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"38⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"39⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"40⤵
- Executes dropped EXE
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"41⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"42⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"43⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"44⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"45⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"46⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"47⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"48⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"49⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"50⤵
- Executes dropped EXE
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"51⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"52⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"53⤵
- Executes dropped EXE
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"54⤵
- Executes dropped EXE
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"55⤵
- Executes dropped EXE
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"56⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"57⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"58⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"59⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"60⤵
- Executes dropped EXE
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"61⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"62⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"63⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"64⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"65⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"66⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"67⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"68⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"69⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"70⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"71⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"72⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"73⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"74⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"75⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"76⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"77⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"78⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"79⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"80⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"81⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"82⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"83⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"84⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"85⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"86⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"87⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"88⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"89⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"90⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"91⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"92⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"93⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"94⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"95⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"96⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"97⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"98⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"99⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"100⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"101⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"102⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"103⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"104⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"105⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"106⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"107⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"108⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"109⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"110⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"111⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"112⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"114⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"115⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"116⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"117⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"118⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"120⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"121⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"122⤵PID:1124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-