Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/04/2024, 16:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
- Target 2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe
- Size 486KB
- Sample240411-tjsb1afb27
- SHA256 eb9a888e00c4f3076d09d32434d58ec1ce6e93574da79991c865d8166429c58b
- MD5 ea3562c9fa94d8abfcb7dd59a686ce5d
- SHA1 71c34a2ad5b39e3df80c3d17f53177665a37b77e
- SHA512 c14ebec9d833b8e8a56e39aeb51ffa8d00271e6b769e6100d922f7df681e384a56722892e70b47d83e5ca9ec3e4961aedaf1de3a382b1050ee99764b5964df80
- SSDEEP 12288:/U5rCOTeiDHQUFnjl8QvREa12LanpRkpYSLNZ:/UQOJDHBFjuQvRYm/v2N
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1868 EDFA.tmp 2236 EF42.tmp 3668 EFEE.tmp 1860 F107.tmp 1668 F1B3.tmp 4172 F29D.tmp 4740 F82B.tmp 3232 FA5E.tmp 3356 FB67.tmp 4308 FC13.tmp 1636 FCBF.tmp 3540 FD9A.tmp 2928 FEB3.tmp 5012 FF6E.tmp 1724 B.tmp 4524 C6.tmp 1596 172.tmp 2388 1FF.tmp 1900 29B.tmp 4736 337.tmp 3780 3B4.tmp 3176 470.tmp 1924 4CD.tmp 4408 54A.tmp 3624 616.tmp 2108 683.tmp 1484 72F.tmp 3276 79C.tmp 4884 867.tmp 4980 952.tmp 4388 9DE.tmp 4064 A7B.tmp 3404 AE8.tmp 5084 B84.tmp 4576 C11.tmp 4340 CAD.tmp 3212 D1A.tmp 2416 DB7.tmp 1804 E24.tmp 4088 EE0.tmp 4236 F9B.tmp 3264 1008.tmp 2680 1085.tmp 4280 119F.tmp 4992 15D5.tmp 3872 1681.tmp 2788 171D.tmp 2696 17B9.tmp 820 1865.tmp 2620 1930.tmp 3132 1A0B.tmp 2928 1B24.tmp 1008 1BD0.tmp 4988 1CAB.tmp 5044 1D66.tmp 1188 1E12.tmp 2528 1EDD.tmp 1648 1FD7.tmp 1900 20B2.tmp 2024 216E.tmp 4756 2258.tmp 4112 22E5.tmp 3368 23DF.tmp 3656 247B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 824 wrote to memory of 1868 824 2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe 90 PID 824 wrote to memory of 1868 824 2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe 90 PID 824 wrote to memory of 1868 824 2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe 90 PID 1868 wrote to memory of 2236 1868 EDFA.tmp 91 PID 1868 wrote to memory of 2236 1868 EDFA.tmp 91 PID 1868 wrote to memory of 2236 1868 EDFA.tmp 91 PID 2236 wrote to memory of 3668 2236 EF42.tmp 92 PID 2236 wrote to memory of 3668 2236 EF42.tmp 92 PID 2236 wrote to memory of 3668 2236 EF42.tmp 92 PID 3668 wrote to memory of 1860 3668 EFEE.tmp 93 PID 3668 wrote to memory of 1860 3668 EFEE.tmp 93 PID 3668 wrote to memory of 1860 3668 EFEE.tmp 93 PID 1860 wrote to memory of 1668 1860 F107.tmp 94 PID 1860 wrote to memory of 1668 1860 F107.tmp 94 PID 1860 wrote to memory of 1668 1860 F107.tmp 94 PID 1668 wrote to memory of 4172 1668 F1B3.tmp 95 PID 1668 wrote to memory of 4172 1668 F1B3.tmp 95 PID 1668 wrote to memory of 4172 1668 F1B3.tmp 95 PID 4172 wrote to memory of 4740 4172 F29D.tmp 96 PID 4172 wrote to memory of 4740 4172 F29D.tmp 96 PID 4172 wrote to memory of 4740 4172 F29D.tmp 96 PID 4740 wrote to memory of 3232 4740 F82B.tmp 97 PID 4740 wrote to memory of 3232 4740 F82B.tmp 97 PID 4740 wrote to memory of 3232 4740 F82B.tmp 97 PID 3232 wrote to memory of 3356 3232 FA5E.tmp 98 PID 3232 wrote to memory of 3356 3232 FA5E.tmp 98 PID 3232 wrote to memory of 3356 3232 FA5E.tmp 98 PID 3356 wrote to memory of 4308 3356 FB67.tmp 99 PID 3356 wrote to memory of 4308 3356 FB67.tmp 99 PID 3356 wrote to memory of 4308 3356 FB67.tmp 99 PID 4308 wrote to memory of 1636 4308 FC13.tmp 100 PID 4308 wrote to memory of 1636 4308 FC13.tmp 100 PID 4308 wrote to memory of 1636 4308 FC13.tmp 100 PID 1636 wrote to memory of 3540 1636 FCBF.tmp 101 PID 1636 wrote to memory of 3540 1636 FCBF.tmp 101 PID 1636 wrote to memory of 3540 1636 FCBF.tmp 101 PID 3540 wrote to memory of 2928 3540 FD9A.tmp 102 PID 3540 wrote to memory of 2928 3540 FD9A.tmp 102 PID 3540 wrote to memory of 2928 3540 FD9A.tmp 102 PID 2928 wrote to memory of 5012 2928 FEB3.tmp 103 PID 2928 wrote to memory of 5012 2928 FEB3.tmp 103 PID 2928 wrote to memory of 5012 2928 FEB3.tmp 103 PID 5012 wrote to memory of 1724 5012 FF6E.tmp 104 PID 5012 wrote to memory of 1724 5012 FF6E.tmp 104 PID 5012 wrote to memory of 1724 5012 FF6E.tmp 104 PID 1724 wrote to memory of 4524 1724 B.tmp 105 PID 1724 wrote to memory of 4524 1724 B.tmp 105 PID 1724 wrote to memory of 4524 1724 B.tmp 105 PID 4524 wrote to memory of 1596 4524 C6.tmp 106 PID 4524 wrote to memory of 1596 4524 C6.tmp 106 PID 4524 wrote to memory of 1596 4524 C6.tmp 106 PID 1596 wrote to memory of 2388 1596 172.tmp 107 PID 1596 wrote to memory of 2388 1596 172.tmp 107 PID 1596 wrote to memory of 2388 1596 172.tmp 107 PID 2388 wrote to memory of 1900 2388 1FF.tmp 108 PID 2388 wrote to memory of 1900 2388 1FF.tmp 108 PID 2388 wrote to memory of 1900 2388 1FF.tmp 108 PID 1900 wrote to memory of 4736 1900 29B.tmp 109 PID 1900 wrote to memory of 4736 1900 29B.tmp 109 PID 1900 wrote to memory of 4736 1900 29B.tmp 109 PID 4736 wrote to memory of 3780 4736 337.tmp 110 PID 4736 wrote to memory of 3780 4736 337.tmp 110 PID 4736 wrote to memory of 3780 4736 337.tmp 110 PID 3780 wrote to memory of 3176 3780 3B4.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_ea3562c9fa94d8abfcb7dd59a686ce5d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"23⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"24⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"25⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"26⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"27⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"28⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"29⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"30⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"31⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"32⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"33⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"34⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"35⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"36⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"37⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"38⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"39⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"40⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"41⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"42⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"43⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"44⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"45⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"46⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"47⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"48⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"49⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"50⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"51⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"52⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"53⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"54⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"55⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"56⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"57⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"58⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"59⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"60⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"61⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"62⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"63⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"64⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"65⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"66⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"67⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"68⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"69⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"70⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"71⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"72⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"73⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"74⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"75⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"76⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"77⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"78⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"79⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"80⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"81⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"82⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"83⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"84⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"85⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"86⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"87⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"88⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"89⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"90⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"91⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"92⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"93⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"94⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"95⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"96⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"97⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"98⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"99⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"101⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"102⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"103⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"104⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"105⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"106⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"107⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"108⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"109⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"110⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"111⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"112⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"113⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"114⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"115⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"116⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"117⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"118⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"119⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"120⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"121⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-