Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe
-
Size
765KB
-
MD5
3818b6af442422d20664ca5cec24dc11
-
SHA1
70802c2185fcd2209541bb7ae86b49ac4dd5c961
-
SHA256
6ce977e2fa353b27df3a1adacd89a2860fea78cd31b12ad7ff3dc24330adae88
-
SHA512
ea4507779f9e72e4bb142c906d5ad14fbf397331e645f98df80783a1162755af17187501bea832a562b46d7aa7e8345073733b2ea2cf847de56276ce55bfcfed
-
SSDEEP
12288:ZU5rCOTeiDghjUbRxMN6FNUsLORwXQNG7Z3ZF5rn5rLOa54U5w5A:ZUQOJDgibRxMN6FNu6QNGN3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1388 2D2A.tmp 2480 2DA7.tmp 1908 2E05.tmp 2056 2EB1.tmp 3756 2F1E.tmp 4976 2F8C.tmp 4932 2FF9.tmp 3032 3066.tmp 1804 30D4.tmp 2652 3132.tmp 4040 31AF.tmp 3852 320C.tmp 3480 327A.tmp 2080 32F7.tmp 4944 3354.tmp 1768 33A3.tmp 1560 33E1.tmp 932 346E.tmp 440 34DB.tmp 1416 3548.tmp 3996 35A6.tmp 4092 3604.tmp 1524 3671.tmp 2000 36CF.tmp 2404 372D.tmp 4632 377B.tmp 2912 37E8.tmp 4472 3856.tmp 3724 38B3.tmp 2484 3921.tmp 2040 397F.tmp 3392 39DC.tmp 1864 3A4A.tmp 4404 3A98.tmp 4276 3AE6.tmp 2500 3B34.tmp 2376 3B92.tmp 2824 3BF0.tmp 720 3C3E.tmp 2772 3C8C.tmp 1192 3CEA.tmp 3500 3D38.tmp 640 3D95.tmp 3540 3DF3.tmp 3908 3E51.tmp 3864 3EAF.tmp 4572 3F0C.tmp 3700 3F6A.tmp 2860 3FC8.tmp 3020 4016.tmp 3992 4064.tmp 4532 40B2.tmp 3556 4100.tmp 1804 414F.tmp 1980 419D.tmp 3156 41EB.tmp 4056 4239.tmp 5096 4287.tmp 4084 42D5.tmp 1932 4333.tmp 388 4381.tmp 876 43CF.tmp 468 442D.tmp 396 448B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 1388 4116 2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe 85 PID 4116 wrote to memory of 1388 4116 2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe 85 PID 4116 wrote to memory of 1388 4116 2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe 85 PID 1388 wrote to memory of 2480 1388 2D2A.tmp 86 PID 1388 wrote to memory of 2480 1388 2D2A.tmp 86 PID 1388 wrote to memory of 2480 1388 2D2A.tmp 86 PID 2480 wrote to memory of 1908 2480 2DA7.tmp 88 PID 2480 wrote to memory of 1908 2480 2DA7.tmp 88 PID 2480 wrote to memory of 1908 2480 2DA7.tmp 88 PID 1908 wrote to memory of 2056 1908 2E05.tmp 90 PID 1908 wrote to memory of 2056 1908 2E05.tmp 90 PID 1908 wrote to memory of 2056 1908 2E05.tmp 90 PID 2056 wrote to memory of 3756 2056 2EB1.tmp 91 PID 2056 wrote to memory of 3756 2056 2EB1.tmp 91 PID 2056 wrote to memory of 3756 2056 2EB1.tmp 91 PID 3756 wrote to memory of 4976 3756 2F1E.tmp 92 PID 3756 wrote to memory of 4976 3756 2F1E.tmp 92 PID 3756 wrote to memory of 4976 3756 2F1E.tmp 92 PID 4976 wrote to memory of 4932 4976 2F8C.tmp 93 PID 4976 wrote to memory of 4932 4976 2F8C.tmp 93 PID 4976 wrote to memory of 4932 4976 2F8C.tmp 93 PID 4932 wrote to memory of 3032 4932 2FF9.tmp 94 PID 4932 wrote to memory of 3032 4932 2FF9.tmp 94 PID 4932 wrote to memory of 3032 4932 2FF9.tmp 94 PID 3032 wrote to memory of 1804 3032 3066.tmp 95 PID 3032 wrote to memory of 1804 3032 3066.tmp 95 PID 3032 wrote to memory of 1804 3032 3066.tmp 95 PID 1804 wrote to memory of 2652 1804 30D4.tmp 96 PID 1804 wrote to memory of 2652 1804 30D4.tmp 96 PID 1804 wrote to memory of 2652 1804 30D4.tmp 96 PID 2652 wrote to memory of 4040 2652 3132.tmp 97 PID 2652 wrote to memory of 4040 2652 3132.tmp 97 PID 2652 wrote to memory of 4040 2652 3132.tmp 97 PID 4040 wrote to memory of 3852 4040 31AF.tmp 98 PID 4040 wrote to memory of 3852 4040 31AF.tmp 98 PID 4040 wrote to memory of 3852 4040 31AF.tmp 98 PID 3852 wrote to memory of 3480 3852 320C.tmp 99 PID 3852 wrote to memory of 3480 3852 320C.tmp 99 PID 3852 wrote to memory of 3480 3852 320C.tmp 99 PID 3480 wrote to memory of 2080 3480 327A.tmp 100 PID 3480 wrote to memory of 2080 3480 327A.tmp 100 PID 3480 wrote to memory of 2080 3480 327A.tmp 100 PID 2080 wrote to memory of 4944 2080 32F7.tmp 101 PID 2080 wrote to memory of 4944 2080 32F7.tmp 101 PID 2080 wrote to memory of 4944 2080 32F7.tmp 101 PID 4944 wrote to memory of 1768 4944 3354.tmp 102 PID 4944 wrote to memory of 1768 4944 3354.tmp 102 PID 4944 wrote to memory of 1768 4944 3354.tmp 102 PID 1768 wrote to memory of 1560 1768 33A3.tmp 103 PID 1768 wrote to memory of 1560 1768 33A3.tmp 103 PID 1768 wrote to memory of 1560 1768 33A3.tmp 103 PID 1560 wrote to memory of 932 1560 33E1.tmp 104 PID 1560 wrote to memory of 932 1560 33E1.tmp 104 PID 1560 wrote to memory of 932 1560 33E1.tmp 104 PID 932 wrote to memory of 440 932 346E.tmp 105 PID 932 wrote to memory of 440 932 346E.tmp 105 PID 932 wrote to memory of 440 932 346E.tmp 105 PID 440 wrote to memory of 1416 440 34DB.tmp 106 PID 440 wrote to memory of 1416 440 34DB.tmp 106 PID 440 wrote to memory of 1416 440 34DB.tmp 106 PID 1416 wrote to memory of 3996 1416 3548.tmp 107 PID 1416 wrote to memory of 3996 1416 3548.tmp 107 PID 1416 wrote to memory of 3996 1416 3548.tmp 107 PID 3996 wrote to memory of 4092 3996 35A6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_3818b6af442422d20664ca5cec24dc11_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2DA7.tmp"C:\Users\Admin\AppData\Local\Temp\2DA7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2E05.tmp"C:\Users\Admin\AppData\Local\Temp\2E05.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3066.tmp"C:\Users\Admin\AppData\Local\Temp\3066.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\30D4.tmp"C:\Users\Admin\AppData\Local\Temp\30D4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\31AF.tmp"C:\Users\Admin\AppData\Local\Temp\31AF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"23⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"24⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"25⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"26⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"27⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"28⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"29⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"30⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"31⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"32⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"33⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"34⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"35⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"36⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"37⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"38⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"39⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"40⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"41⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"42⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"43⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"44⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"45⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"46⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"47⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"48⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"49⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"50⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"51⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"52⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"53⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"54⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"55⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"56⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"57⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"58⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"59⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"60⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"61⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"62⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"63⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"64⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"65⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"66⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"67⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"68⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"69⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"70⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"71⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"72⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"73⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"74⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"75⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"76⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"77⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"78⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"79⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"80⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"81⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"82⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"83⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"84⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"85⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"86⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"87⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"88⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"89⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"90⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"91⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"92⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"93⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"94⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"95⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"96⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"97⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"98⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"99⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"100⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"101⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"102⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"103⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"104⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"105⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"106⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"107⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"108⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"109⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"110⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"111⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"112⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"113⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"114⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"115⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"116⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"118⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"119⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"120⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"121⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-