Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe
-
Size
488KB
-
MD5
cb518a2a4e6d87b8a1c284bbfc657720
-
SHA1
3ad4ae398cb43c8658247915d49d1de05b62da93
-
SHA256
c57b58c11e0869083d728deca76a1e1234bf6561c4933c20cfbbdefef73ff2dd
-
SHA512
aac88d0c9d698bd7326ac8aeddcae1ff0efc34f976dc34416e896ee7091a34d606fdf01ee89d5eda9572172e2dfc5ee023ce0c7e76e7112d6d26f6a0573314c7
-
SSDEEP
12288:/U5rCOTeiDUxtLgqGd5DvMiYdD29hZLYcDvxNZ:/UQOJDUxxGdRvjEshCcNN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4060 2E53.tmp 1664 2EC1.tmp 1972 2F2E.tmp 2360 2FAB.tmp 5068 3009.tmp 5084 3057.tmp 3508 30B5.tmp 1220 3112.tmp 3760 3170.tmp 4836 31DD.tmp 4504 323B.tmp 4048 32B8.tmp 4080 3326.tmp 1380 3383.tmp 452 3400.tmp 2040 347D.tmp 892 34DB.tmp 4084 3558.tmp 4936 35A6.tmp 4540 3604.tmp 1636 3681.tmp 3472 36EE.tmp 948 375C.tmp 4052 37AA.tmp 4400 3808.tmp 3504 3875.tmp 1924 38E2.tmp 4008 3950.tmp 3544 399E.tmp 4972 3A0B.tmp 2432 3A59.tmp 2556 3AC7.tmp 4512 3B24.tmp 3624 3B82.tmp 920 3BD0.tmp 2324 3C3E.tmp 1776 3C8C.tmp 1840 3CF9.tmp 2360 3D47.tmp 2104 3D95.tmp 4404 3DF3.tmp 2884 3E41.tmp 3740 3E9F.tmp 436 3EFD.tmp 1620 3F4B.tmp 1832 3F99.tmp 780 3FF7.tmp 2444 4045.tmp 4644 40A3.tmp 208 40F1.tmp 728 414F.tmp 552 419D.tmp 880 41EB.tmp 2424 4239.tmp 1848 4297.tmp 2768 42F4.tmp 452 4352.tmp 2500 43B0.tmp 2876 440E.tmp 4488 446B.tmp 1612 44C9.tmp 4936 4517.tmp 1496 4575.tmp 3032 45C3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 4060 2044 2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe 85 PID 2044 wrote to memory of 4060 2044 2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe 85 PID 2044 wrote to memory of 4060 2044 2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe 85 PID 4060 wrote to memory of 1664 4060 2E53.tmp 86 PID 4060 wrote to memory of 1664 4060 2E53.tmp 86 PID 4060 wrote to memory of 1664 4060 2E53.tmp 86 PID 1664 wrote to memory of 1972 1664 2EC1.tmp 87 PID 1664 wrote to memory of 1972 1664 2EC1.tmp 87 PID 1664 wrote to memory of 1972 1664 2EC1.tmp 87 PID 1972 wrote to memory of 2360 1972 2F2E.tmp 89 PID 1972 wrote to memory of 2360 1972 2F2E.tmp 89 PID 1972 wrote to memory of 2360 1972 2F2E.tmp 89 PID 2360 wrote to memory of 5068 2360 2FAB.tmp 91 PID 2360 wrote to memory of 5068 2360 2FAB.tmp 91 PID 2360 wrote to memory of 5068 2360 2FAB.tmp 91 PID 5068 wrote to memory of 5084 5068 3009.tmp 93 PID 5068 wrote to memory of 5084 5068 3009.tmp 93 PID 5068 wrote to memory of 5084 5068 3009.tmp 93 PID 5084 wrote to memory of 3508 5084 3057.tmp 94 PID 5084 wrote to memory of 3508 5084 3057.tmp 94 PID 5084 wrote to memory of 3508 5084 3057.tmp 94 PID 3508 wrote to memory of 1220 3508 30B5.tmp 95 PID 3508 wrote to memory of 1220 3508 30B5.tmp 95 PID 3508 wrote to memory of 1220 3508 30B5.tmp 95 PID 1220 wrote to memory of 3760 1220 3112.tmp 96 PID 1220 wrote to memory of 3760 1220 3112.tmp 96 PID 1220 wrote to memory of 3760 1220 3112.tmp 96 PID 3760 wrote to memory of 4836 3760 3170.tmp 97 PID 3760 wrote to memory of 4836 3760 3170.tmp 97 PID 3760 wrote to memory of 4836 3760 3170.tmp 97 PID 4836 wrote to memory of 4504 4836 31DD.tmp 98 PID 4836 wrote to memory of 4504 4836 31DD.tmp 98 PID 4836 wrote to memory of 4504 4836 31DD.tmp 98 PID 4504 wrote to memory of 4048 4504 323B.tmp 99 PID 4504 wrote to memory of 4048 4504 323B.tmp 99 PID 4504 wrote to memory of 4048 4504 323B.tmp 99 PID 4048 wrote to memory of 4080 4048 32B8.tmp 100 PID 4048 wrote to memory of 4080 4048 32B8.tmp 100 PID 4048 wrote to memory of 4080 4048 32B8.tmp 100 PID 4080 wrote to memory of 1380 4080 3326.tmp 101 PID 4080 wrote to memory of 1380 4080 3326.tmp 101 PID 4080 wrote to memory of 1380 4080 3326.tmp 101 PID 1380 wrote to memory of 452 1380 3383.tmp 102 PID 1380 wrote to memory of 452 1380 3383.tmp 102 PID 1380 wrote to memory of 452 1380 3383.tmp 102 PID 452 wrote to memory of 2040 452 3400.tmp 103 PID 452 wrote to memory of 2040 452 3400.tmp 103 PID 452 wrote to memory of 2040 452 3400.tmp 103 PID 2040 wrote to memory of 892 2040 347D.tmp 104 PID 2040 wrote to memory of 892 2040 347D.tmp 104 PID 2040 wrote to memory of 892 2040 347D.tmp 104 PID 892 wrote to memory of 4084 892 34DB.tmp 105 PID 892 wrote to memory of 4084 892 34DB.tmp 105 PID 892 wrote to memory of 4084 892 34DB.tmp 105 PID 4084 wrote to memory of 4936 4084 3558.tmp 106 PID 4084 wrote to memory of 4936 4084 3558.tmp 106 PID 4084 wrote to memory of 4936 4084 3558.tmp 106 PID 4936 wrote to memory of 4540 4936 35A6.tmp 107 PID 4936 wrote to memory of 4540 4936 35A6.tmp 107 PID 4936 wrote to memory of 4540 4936 35A6.tmp 107 PID 4540 wrote to memory of 1636 4540 3604.tmp 108 PID 4540 wrote to memory of 1636 4540 3604.tmp 108 PID 4540 wrote to memory of 1636 4540 3604.tmp 108 PID 1636 wrote to memory of 3472 1636 3681.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_cb518a2a4e6d87b8a1c284bbfc657720_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2E53.tmp"C:\Users\Admin\AppData\Local\Temp\2E53.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2F2E.tmp"C:\Users\Admin\AppData\Local\Temp\2F2E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3009.tmp"C:\Users\Admin\AppData\Local\Temp\3009.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\3057.tmp"C:\Users\Admin\AppData\Local\Temp\3057.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\3112.tmp"C:\Users\Admin\AppData\Local\Temp\3112.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\323B.tmp"C:\Users\Admin\AppData\Local\Temp\323B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"23⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"24⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"25⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"26⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"27⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"28⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"29⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"30⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"31⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"32⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"33⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"34⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"35⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"36⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"37⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"38⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"39⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"40⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"41⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"42⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"43⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"44⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"45⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"46⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"47⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"48⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"49⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"50⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"51⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"52⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"53⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"54⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"55⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"56⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"57⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"58⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"59⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"60⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"61⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"62⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"63⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"64⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"65⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"66⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"67⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"68⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"69⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"70⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"71⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"72⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"73⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"74⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"75⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"76⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"77⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"78⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"79⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"80⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"81⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"82⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"83⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"84⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"85⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"86⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"87⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"88⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"89⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"90⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"91⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"92⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"93⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"94⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"95⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"96⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"97⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"98⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"99⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"100⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"101⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"102⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"103⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"104⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"105⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"106⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"107⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"108⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"109⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"110⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"111⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"112⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"113⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"114⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"115⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"116⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"117⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"118⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"119⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"120⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"121⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-