Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 13:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe
-
Size
527KB
-
MD5
5da825490cc4d9c9810991cc8d494ca3
-
SHA1
85a1c0441603568f1953e5d3a96faeff1d400b09
-
SHA256
97f0ee915be17cdf1fd0e0c728fc562723ce12d2e3f7811d7ac04b8f4c6a30ee
-
SHA512
1a688401df90ed35fd020b9620fdb68cfb485b1399e8e5ec1a0380cf9c2c8ee5bd25b76a78592fe538dc0c4b9f1e24d1405ec2758e6d0da2ba745f55b2567bdd
-
SSDEEP
12288:fU5rCOTeidOklKd3qMOGbrMmTHM+B560OzhDZu:fUQOJdPKd3qbGXMl+360OzhDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1500 5B9D.tmp 2604 5C1A.tmp 4480 5C78.tmp 1368 5D14.tmp 3816 5D91.tmp 1924 5DFE.tmp 4760 5E7B.tmp 2644 5ED9.tmp 4508 5F46.tmp 4696 5F95.tmp 3264 5FF2.tmp 1940 6060.tmp 1188 60BD.tmp 4312 613A.tmp 500 61B7.tmp 904 6206.tmp 3928 6254.tmp 4228 62D1.tmp 220 632E.tmp 3328 637D.tmp 4868 63FA.tmp 2096 6486.tmp 2880 6503.tmp 4304 6590.tmp 1076 65DE.tmp 2252 666B.tmp 4412 66E8.tmp 3960 6736.tmp 1928 67A3.tmp 3524 6810.tmp 4064 687E.tmp 4472 68EB.tmp 1936 6968.tmp 4256 69C6.tmp 4196 6A14.tmp 3972 6A62.tmp 1612 6AC0.tmp 640 6B1E.tmp 3140 6B6C.tmp 4560 6BCA.tmp 3080 6C18.tmp 2652 6C75.tmp 1944 6CC4.tmp 2956 6D12.tmp 4808 6D60.tmp 1816 6DAE.tmp 2568 6DFC.tmp 4976 6E5A.tmp 4952 6EA8.tmp 3576 6F06.tmp 4528 6F63.tmp 2012 6FC1.tmp 852 701F.tmp 1384 707D.tmp 1452 70DA.tmp 4080 7138.tmp 656 7196.tmp 4024 71E4.tmp 4016 7242.tmp 4772 72BF.tmp 3680 730D.tmp 3320 735B.tmp 3696 73B9.tmp 3960 7426.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 1500 3924 2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe 86 PID 3924 wrote to memory of 1500 3924 2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe 86 PID 3924 wrote to memory of 1500 3924 2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe 86 PID 1500 wrote to memory of 2604 1500 5B9D.tmp 87 PID 1500 wrote to memory of 2604 1500 5B9D.tmp 87 PID 1500 wrote to memory of 2604 1500 5B9D.tmp 87 PID 2604 wrote to memory of 4480 2604 5C1A.tmp 89 PID 2604 wrote to memory of 4480 2604 5C1A.tmp 89 PID 2604 wrote to memory of 4480 2604 5C1A.tmp 89 PID 4480 wrote to memory of 1368 4480 5C78.tmp 91 PID 4480 wrote to memory of 1368 4480 5C78.tmp 91 PID 4480 wrote to memory of 1368 4480 5C78.tmp 91 PID 1368 wrote to memory of 3816 1368 5D14.tmp 92 PID 1368 wrote to memory of 3816 1368 5D14.tmp 92 PID 1368 wrote to memory of 3816 1368 5D14.tmp 92 PID 3816 wrote to memory of 1924 3816 5D91.tmp 94 PID 3816 wrote to memory of 1924 3816 5D91.tmp 94 PID 3816 wrote to memory of 1924 3816 5D91.tmp 94 PID 1924 wrote to memory of 4760 1924 5DFE.tmp 95 PID 1924 wrote to memory of 4760 1924 5DFE.tmp 95 PID 1924 wrote to memory of 4760 1924 5DFE.tmp 95 PID 4760 wrote to memory of 2644 4760 5E7B.tmp 96 PID 4760 wrote to memory of 2644 4760 5E7B.tmp 96 PID 4760 wrote to memory of 2644 4760 5E7B.tmp 96 PID 2644 wrote to memory of 4508 2644 5ED9.tmp 97 PID 2644 wrote to memory of 4508 2644 5ED9.tmp 97 PID 2644 wrote to memory of 4508 2644 5ED9.tmp 97 PID 4508 wrote to memory of 4696 4508 5F46.tmp 98 PID 4508 wrote to memory of 4696 4508 5F46.tmp 98 PID 4508 wrote to memory of 4696 4508 5F46.tmp 98 PID 4696 wrote to memory of 3264 4696 5F95.tmp 99 PID 4696 wrote to memory of 3264 4696 5F95.tmp 99 PID 4696 wrote to memory of 3264 4696 5F95.tmp 99 PID 3264 wrote to memory of 1940 3264 5FF2.tmp 100 PID 3264 wrote to memory of 1940 3264 5FF2.tmp 100 PID 3264 wrote to memory of 1940 3264 5FF2.tmp 100 PID 1940 wrote to memory of 1188 1940 6060.tmp 101 PID 1940 wrote to memory of 1188 1940 6060.tmp 101 PID 1940 wrote to memory of 1188 1940 6060.tmp 101 PID 1188 wrote to memory of 4312 1188 60BD.tmp 102 PID 1188 wrote to memory of 4312 1188 60BD.tmp 102 PID 1188 wrote to memory of 4312 1188 60BD.tmp 102 PID 4312 wrote to memory of 500 4312 613A.tmp 103 PID 4312 wrote to memory of 500 4312 613A.tmp 103 PID 4312 wrote to memory of 500 4312 613A.tmp 103 PID 500 wrote to memory of 904 500 61B7.tmp 104 PID 500 wrote to memory of 904 500 61B7.tmp 104 PID 500 wrote to memory of 904 500 61B7.tmp 104 PID 904 wrote to memory of 3928 904 6206.tmp 105 PID 904 wrote to memory of 3928 904 6206.tmp 105 PID 904 wrote to memory of 3928 904 6206.tmp 105 PID 3928 wrote to memory of 4228 3928 6254.tmp 106 PID 3928 wrote to memory of 4228 3928 6254.tmp 106 PID 3928 wrote to memory of 4228 3928 6254.tmp 106 PID 4228 wrote to memory of 220 4228 62D1.tmp 107 PID 4228 wrote to memory of 220 4228 62D1.tmp 107 PID 4228 wrote to memory of 220 4228 62D1.tmp 107 PID 220 wrote to memory of 3328 220 632E.tmp 108 PID 220 wrote to memory of 3328 220 632E.tmp 108 PID 220 wrote to memory of 3328 220 632E.tmp 108 PID 3328 wrote to memory of 4868 3328 637D.tmp 109 PID 3328 wrote to memory of 4868 3328 637D.tmp 109 PID 3328 wrote to memory of 4868 3328 637D.tmp 109 PID 4868 wrote to memory of 2096 4868 63FA.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_5da825490cc4d9c9810991cc8d494ca3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"23⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"24⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"25⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"26⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"27⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"28⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"29⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"30⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"31⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"32⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"33⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"34⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"35⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"36⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"37⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"38⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"39⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"40⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"41⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"42⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"43⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"44⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"45⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"46⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"47⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"48⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"49⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"50⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"51⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"52⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"53⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"54⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"55⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"56⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"57⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"58⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"59⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"60⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"61⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"62⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"63⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"64⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"65⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"66⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"67⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"68⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"69⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"70⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"71⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"72⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"73⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"74⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"75⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"76⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"77⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"78⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"79⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"80⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"81⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"82⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"83⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"84⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"85⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"86⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"87⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"88⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"89⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"90⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"91⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"94⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"95⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"96⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"97⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"98⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"99⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"100⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"101⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"102⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"103⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"105⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"106⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"107⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"108⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"109⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"110⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"111⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"112⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"113⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"114⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"115⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"116⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"117⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"118⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"119⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"120⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"121⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-