Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe
-
Size
486KB
-
MD5
2d9acc2482d8ff611735d0b1a7ab4389
-
SHA1
cb0bb7e66803fdf28361832a74e06f57b48edfe0
-
SHA256
394a81b1cdea8d21d3f28792d0d9c11dabd17fe8e4f1767cb7ee4c313a335bde
-
SHA512
08748c120e7349c0c40d97fcfc608616fd0e67c67f4903b5a07668797745282c7512776631d18f0cc25d248fc88710030f9cbf84a7288da11f5597b580f42861
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJSEh7GjWi+43DpyMhhIQ0zA1Msv8AAQdzJyM8:/U5rCOTeiDQEFGzl3Dpjh6beMlAA0t
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1600 33D1.tmp 4536 344E.tmp 3060 349D.tmp 1300 34FA.tmp 3148 3577.tmp 1452 35D5.tmp 3972 3633.tmp 5080 36A0.tmp 2520 36EE.tmp 3764 375C.tmp 4980 37AA.tmp 4396 37F8.tmp 5076 3846.tmp 1852 38A4.tmp 1076 3902.tmp 4840 396F.tmp 4276 39CD.tmp 3052 3A1B.tmp 3300 3A88.tmp 3716 3AD6.tmp 3068 3B53.tmp 3112 3BC1.tmp 964 3C1E.tmp 4860 3C7C.tmp 2548 3CEA.tmp 3984 3D57.tmp 4352 3DB5.tmp 2624 3E22.tmp 1688 3E8F.tmp 4628 3EED.tmp 4412 3F5B.tmp 5032 3FB8.tmp 3320 4006.tmp 4916 4045.tmp 2668 4093.tmp 632 40E1.tmp 3612 412F.tmp 436 417D.tmp 2540 41CC.tmp 3256 421A.tmp 1820 4268.tmp 3168 42B6.tmp 4144 4304.tmp 840 4352.tmp 3132 43A0.tmp 1884 43EE.tmp 2000 443D.tmp 1124 448B.tmp 4848 44D9.tmp 4348 4537.tmp 1296 4594.tmp 2012 45E2.tmp 4072 4631.tmp 2288 468E.tmp 1232 46DC.tmp 3268 473A.tmp 3460 4788.tmp 3288 47D6.tmp 3148 4825.tmp 1488 4882.tmp 3312 48D0.tmp 3636 491F.tmp 3972 496D.tmp 1512 49BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1600 4612 2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe 85 PID 4612 wrote to memory of 1600 4612 2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe 85 PID 4612 wrote to memory of 1600 4612 2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe 85 PID 1600 wrote to memory of 4536 1600 33D1.tmp 86 PID 1600 wrote to memory of 4536 1600 33D1.tmp 86 PID 1600 wrote to memory of 4536 1600 33D1.tmp 86 PID 4536 wrote to memory of 3060 4536 344E.tmp 87 PID 4536 wrote to memory of 3060 4536 344E.tmp 87 PID 4536 wrote to memory of 3060 4536 344E.tmp 87 PID 3060 wrote to memory of 1300 3060 349D.tmp 88 PID 3060 wrote to memory of 1300 3060 349D.tmp 88 PID 3060 wrote to memory of 1300 3060 349D.tmp 88 PID 1300 wrote to memory of 3148 1300 34FA.tmp 89 PID 1300 wrote to memory of 3148 1300 34FA.tmp 89 PID 1300 wrote to memory of 3148 1300 34FA.tmp 89 PID 3148 wrote to memory of 1452 3148 3577.tmp 90 PID 3148 wrote to memory of 1452 3148 3577.tmp 90 PID 3148 wrote to memory of 1452 3148 3577.tmp 90 PID 1452 wrote to memory of 3972 1452 35D5.tmp 91 PID 1452 wrote to memory of 3972 1452 35D5.tmp 91 PID 1452 wrote to memory of 3972 1452 35D5.tmp 91 PID 3972 wrote to memory of 5080 3972 3633.tmp 92 PID 3972 wrote to memory of 5080 3972 3633.tmp 92 PID 3972 wrote to memory of 5080 3972 3633.tmp 92 PID 5080 wrote to memory of 2520 5080 36A0.tmp 93 PID 5080 wrote to memory of 2520 5080 36A0.tmp 93 PID 5080 wrote to memory of 2520 5080 36A0.tmp 93 PID 2520 wrote to memory of 3764 2520 36EE.tmp 94 PID 2520 wrote to memory of 3764 2520 36EE.tmp 94 PID 2520 wrote to memory of 3764 2520 36EE.tmp 94 PID 3764 wrote to memory of 4980 3764 375C.tmp 95 PID 3764 wrote to memory of 4980 3764 375C.tmp 95 PID 3764 wrote to memory of 4980 3764 375C.tmp 95 PID 4980 wrote to memory of 4396 4980 37AA.tmp 96 PID 4980 wrote to memory of 4396 4980 37AA.tmp 96 PID 4980 wrote to memory of 4396 4980 37AA.tmp 96 PID 4396 wrote to memory of 5076 4396 37F8.tmp 97 PID 4396 wrote to memory of 5076 4396 37F8.tmp 97 PID 4396 wrote to memory of 5076 4396 37F8.tmp 97 PID 5076 wrote to memory of 1852 5076 3846.tmp 98 PID 5076 wrote to memory of 1852 5076 3846.tmp 98 PID 5076 wrote to memory of 1852 5076 3846.tmp 98 PID 1852 wrote to memory of 1076 1852 38A4.tmp 99 PID 1852 wrote to memory of 1076 1852 38A4.tmp 99 PID 1852 wrote to memory of 1076 1852 38A4.tmp 99 PID 1076 wrote to memory of 4840 1076 3902.tmp 100 PID 1076 wrote to memory of 4840 1076 3902.tmp 100 PID 1076 wrote to memory of 4840 1076 3902.tmp 100 PID 4840 wrote to memory of 4276 4840 396F.tmp 101 PID 4840 wrote to memory of 4276 4840 396F.tmp 101 PID 4840 wrote to memory of 4276 4840 396F.tmp 101 PID 4276 wrote to memory of 3052 4276 39CD.tmp 102 PID 4276 wrote to memory of 3052 4276 39CD.tmp 102 PID 4276 wrote to memory of 3052 4276 39CD.tmp 102 PID 3052 wrote to memory of 3300 3052 3A1B.tmp 103 PID 3052 wrote to memory of 3300 3052 3A1B.tmp 103 PID 3052 wrote to memory of 3300 3052 3A1B.tmp 103 PID 3300 wrote to memory of 3716 3300 3A88.tmp 104 PID 3300 wrote to memory of 3716 3300 3A88.tmp 104 PID 3300 wrote to memory of 3716 3300 3A88.tmp 104 PID 3716 wrote to memory of 3068 3716 3AD6.tmp 105 PID 3716 wrote to memory of 3068 3716 3AD6.tmp 105 PID 3716 wrote to memory of 3068 3716 3AD6.tmp 105 PID 3068 wrote to memory of 3112 3068 3B53.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_2d9acc2482d8ff611735d0b1a7ab4389_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"23⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"24⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"25⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"26⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"27⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"28⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"29⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"30⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"31⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"32⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"33⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"34⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"35⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"36⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"37⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"38⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"39⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"40⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"41⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"42⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"43⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"44⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"45⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"46⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"47⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"48⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"49⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"50⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"51⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"52⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"53⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"54⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"55⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"56⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"57⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"58⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"59⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"60⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"61⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"62⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"63⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"64⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"65⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"66⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"67⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"68⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"69⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"70⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"71⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"72⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"73⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"74⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"75⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"76⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"77⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"78⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"79⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"80⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"81⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"82⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"83⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"84⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"85⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"86⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"87⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"88⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"89⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"90⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"91⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"92⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"93⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"95⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"96⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"97⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"98⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"99⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"100⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"101⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"102⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"103⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"104⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"105⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"106⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"107⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"108⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"109⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"110⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"111⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"112⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"113⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"114⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"115⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"116⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"117⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"118⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"119⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"120⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"121⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-