Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 00:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe
Resource
win7-20240319-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe
-
Size
486KB
-
MD5
7bea38327559e2ea9345a967d4c003bc
-
SHA1
2dd65c5da9a8f55a491e978cc0137ff3a5d31ae2
-
SHA256
9b6653938a42243af7b9ab0710f896b74e0ce2b93cca31657c0985ca90362cd8
-
SHA512
5468ce122eb40733dca6242a0387ba775d3fb414f4ff466a009b296a1399efcdaf4f82e78b1f9a4487df2a1c26eba828f54a27f3cbeb0358449d4b97fbe3ff9f
-
SSDEEP
12288:/U5rCOTeiDFUg+YRFIr/RFmiZkfzVtg62wNZ:/UQOJDt0JvirH5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2332 30E3.tmp 1156 3151.tmp 2308 31BE.tmp 3704 322C.tmp 3816 3299.tmp 4584 3306.tmp 3844 3354.tmp 1616 33B2.tmp 2768 3420.tmp 3624 348D.tmp 3860 34FA.tmp 3964 3568.tmp 4340 35B6.tmp 3320 3623.tmp 3008 3691.tmp 772 36FE.tmp 3596 376B.tmp 640 37B9.tmp 4272 3827.tmp 2184 3894.tmp 3512 3911.tmp 3012 397F.tmp 4588 39CD.tmp 4976 3A2A.tmp 3700 3A98.tmp 2756 3B05.tmp 4604 3B63.tmp 3436 3BF0.tmp 3736 3C4D.tmp 3836 3CBB.tmp 4388 3D38.tmp 4704 3D95.tmp 1716 3E03.tmp 3908 3E61.tmp 4004 3EBE.tmp 4952 3F0C.tmp 544 3F6A.tmp 4352 3FB8.tmp 5036 4016.tmp 2212 4074.tmp 4872 40C2.tmp 4640 4110.tmp 1372 416E.tmp 1720 41CC.tmp 5020 421A.tmp 1736 4268.tmp 2916 42C6.tmp 3976 4323.tmp 4128 4371.tmp 2140 43CF.tmp 1692 442D.tmp 2264 447B.tmp 1480 44C9.tmp 2672 4517.tmp 1176 4565.tmp 524 45B4.tmp 2544 4602.tmp 712 4650.tmp 1512 46AE.tmp 5040 46FC.tmp 4476 474A.tmp 552 4798.tmp 2504 47F6.tmp 3196 4853.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2332 1808 2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe 85 PID 1808 wrote to memory of 2332 1808 2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe 85 PID 1808 wrote to memory of 2332 1808 2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe 85 PID 2332 wrote to memory of 1156 2332 30E3.tmp 86 PID 2332 wrote to memory of 1156 2332 30E3.tmp 86 PID 2332 wrote to memory of 1156 2332 30E3.tmp 86 PID 1156 wrote to memory of 2308 1156 3151.tmp 88 PID 1156 wrote to memory of 2308 1156 3151.tmp 88 PID 1156 wrote to memory of 2308 1156 3151.tmp 88 PID 2308 wrote to memory of 3704 2308 31BE.tmp 89 PID 2308 wrote to memory of 3704 2308 31BE.tmp 89 PID 2308 wrote to memory of 3704 2308 31BE.tmp 89 PID 3704 wrote to memory of 3816 3704 322C.tmp 91 PID 3704 wrote to memory of 3816 3704 322C.tmp 91 PID 3704 wrote to memory of 3816 3704 322C.tmp 91 PID 3816 wrote to memory of 4584 3816 3299.tmp 92 PID 3816 wrote to memory of 4584 3816 3299.tmp 92 PID 3816 wrote to memory of 4584 3816 3299.tmp 92 PID 4584 wrote to memory of 3844 4584 3306.tmp 93 PID 4584 wrote to memory of 3844 4584 3306.tmp 93 PID 4584 wrote to memory of 3844 4584 3306.tmp 93 PID 3844 wrote to memory of 1616 3844 3354.tmp 94 PID 3844 wrote to memory of 1616 3844 3354.tmp 94 PID 3844 wrote to memory of 1616 3844 3354.tmp 94 PID 1616 wrote to memory of 2768 1616 33B2.tmp 95 PID 1616 wrote to memory of 2768 1616 33B2.tmp 95 PID 1616 wrote to memory of 2768 1616 33B2.tmp 95 PID 2768 wrote to memory of 3624 2768 3420.tmp 96 PID 2768 wrote to memory of 3624 2768 3420.tmp 96 PID 2768 wrote to memory of 3624 2768 3420.tmp 96 PID 3624 wrote to memory of 3860 3624 348D.tmp 97 PID 3624 wrote to memory of 3860 3624 348D.tmp 97 PID 3624 wrote to memory of 3860 3624 348D.tmp 97 PID 3860 wrote to memory of 3964 3860 34FA.tmp 98 PID 3860 wrote to memory of 3964 3860 34FA.tmp 98 PID 3860 wrote to memory of 3964 3860 34FA.tmp 98 PID 3964 wrote to memory of 4340 3964 3568.tmp 99 PID 3964 wrote to memory of 4340 3964 3568.tmp 99 PID 3964 wrote to memory of 4340 3964 3568.tmp 99 PID 4340 wrote to memory of 3320 4340 35B6.tmp 100 PID 4340 wrote to memory of 3320 4340 35B6.tmp 100 PID 4340 wrote to memory of 3320 4340 35B6.tmp 100 PID 3320 wrote to memory of 3008 3320 3623.tmp 101 PID 3320 wrote to memory of 3008 3320 3623.tmp 101 PID 3320 wrote to memory of 3008 3320 3623.tmp 101 PID 3008 wrote to memory of 772 3008 3691.tmp 102 PID 3008 wrote to memory of 772 3008 3691.tmp 102 PID 3008 wrote to memory of 772 3008 3691.tmp 102 PID 772 wrote to memory of 3596 772 36FE.tmp 103 PID 772 wrote to memory of 3596 772 36FE.tmp 103 PID 772 wrote to memory of 3596 772 36FE.tmp 103 PID 3596 wrote to memory of 640 3596 376B.tmp 104 PID 3596 wrote to memory of 640 3596 376B.tmp 104 PID 3596 wrote to memory of 640 3596 376B.tmp 104 PID 640 wrote to memory of 4272 640 37B9.tmp 105 PID 640 wrote to memory of 4272 640 37B9.tmp 105 PID 640 wrote to memory of 4272 640 37B9.tmp 105 PID 4272 wrote to memory of 2184 4272 3827.tmp 106 PID 4272 wrote to memory of 2184 4272 3827.tmp 106 PID 4272 wrote to memory of 2184 4272 3827.tmp 106 PID 2184 wrote to memory of 3512 2184 3894.tmp 107 PID 2184 wrote to memory of 3512 2184 3894.tmp 107 PID 2184 wrote to memory of 3512 2184 3894.tmp 107 PID 3512 wrote to memory of 3012 3512 3911.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_7bea38327559e2ea9345a967d4c003bc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\322C.tmp"C:\Users\Admin\AppData\Local\Temp\322C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"23⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"24⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"25⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"26⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"27⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"28⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"29⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"30⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"31⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"32⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"33⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"34⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"35⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"36⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"37⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"38⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"39⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"40⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"41⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"42⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"43⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"44⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"45⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"46⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"47⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"48⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"49⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"50⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"51⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"52⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"53⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"54⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"55⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"56⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"57⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"58⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"59⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"60⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"61⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"62⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"63⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"64⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"65⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"66⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"67⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"68⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"69⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"70⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"71⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"72⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"73⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"74⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"75⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"76⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"77⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"80⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"81⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"82⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"83⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"84⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"85⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"86⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"87⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"88⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"89⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"90⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"91⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"93⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"94⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"95⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"97⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"98⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"99⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"100⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"101⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"102⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"103⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"104⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"105⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"106⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"107⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"108⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"109⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"110⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"111⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"112⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"113⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"114⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"115⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"116⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"117⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"118⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"119⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"120⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"121⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"122⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-