Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe
-
Size
520KB
-
MD5
c41d2870262016cd57b7ee9f6d52c6e2
-
SHA1
472431705dab87bd9fca66084a0059d3c02b66ce
-
SHA256
d61469404511325d1a6c4d49447f757660d2fb550c14a5cd0327211b077d873d
-
SHA512
e34615968303ca1674e4fce20f08ee724b1de1f8a9bb97ee526044c1271b7e344525d4a556f067aaed6fbdfef1bde9a3447c54febbeaac6ec4bfb46c27d03789
-
SSDEEP
12288:roRXOQjmOy72EQPjZ3UoYpF2zFaYZ338upNZ:rogQ9y7kbZ3UoYpF2zBOupN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2268 31ED.tmp 3740 326A.tmp 4024 32C8.tmp 3056 3326.tmp 2340 33A3.tmp 3312 342F.tmp 4496 349D.tmp 860 34EB.tmp 4072 3539.tmp 1512 35A6.tmp 5076 3614.tmp 4488 3662.tmp 3044 36B0.tmp 2988 371D.tmp 4428 377B.tmp 5064 37C9.tmp 3668 3846.tmp 4816 38B3.tmp 4160 3921.tmp 4660 398E.tmp 776 39EC.tmp 3620 3A3A.tmp 5004 3A98.tmp 4872 3AE6.tmp 4452 3B34.tmp 2760 3B92.tmp 3372 3BE0.tmp 3880 3C2E.tmp 2568 3C9B.tmp 4180 3D09.tmp 3128 3D67.tmp 4648 3DD4.tmp 4156 3E22.tmp 1048 3E70.tmp 448 3EBE.tmp 3728 3F1C.tmp 212 3F6A.tmp 3416 3FD8.tmp 348 4035.tmp 3296 4093.tmp 3240 40E1.tmp 1420 417D.tmp 1584 41DB.tmp 4116 4239.tmp 1812 4297.tmp 3740 42E5.tmp 4820 4343.tmp 4040 4391.tmp 4928 43EE.tmp 1884 445C.tmp 3384 44BA.tmp 832 4517.tmp 2244 4575.tmp 1136 45C3.tmp 3312 4621.tmp 2596 466F.tmp 1916 46BD.tmp 2592 471B.tmp 4072 4769.tmp 936 47B7.tmp 2124 4805.tmp 1036 4853.tmp 3008 48A2.tmp 2080 48FF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 2268 3124 2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe 85 PID 3124 wrote to memory of 2268 3124 2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe 85 PID 3124 wrote to memory of 2268 3124 2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe 85 PID 2268 wrote to memory of 3740 2268 31ED.tmp 87 PID 2268 wrote to memory of 3740 2268 31ED.tmp 87 PID 2268 wrote to memory of 3740 2268 31ED.tmp 87 PID 3740 wrote to memory of 4024 3740 326A.tmp 88 PID 3740 wrote to memory of 4024 3740 326A.tmp 88 PID 3740 wrote to memory of 4024 3740 326A.tmp 88 PID 4024 wrote to memory of 3056 4024 32C8.tmp 90 PID 4024 wrote to memory of 3056 4024 32C8.tmp 90 PID 4024 wrote to memory of 3056 4024 32C8.tmp 90 PID 3056 wrote to memory of 2340 3056 3326.tmp 92 PID 3056 wrote to memory of 2340 3056 3326.tmp 92 PID 3056 wrote to memory of 2340 3056 3326.tmp 92 PID 2340 wrote to memory of 3312 2340 33A3.tmp 93 PID 2340 wrote to memory of 3312 2340 33A3.tmp 93 PID 2340 wrote to memory of 3312 2340 33A3.tmp 93 PID 3312 wrote to memory of 4496 3312 342F.tmp 94 PID 3312 wrote to memory of 4496 3312 342F.tmp 94 PID 3312 wrote to memory of 4496 3312 342F.tmp 94 PID 4496 wrote to memory of 860 4496 349D.tmp 95 PID 4496 wrote to memory of 860 4496 349D.tmp 95 PID 4496 wrote to memory of 860 4496 349D.tmp 95 PID 860 wrote to memory of 4072 860 34EB.tmp 96 PID 860 wrote to memory of 4072 860 34EB.tmp 96 PID 860 wrote to memory of 4072 860 34EB.tmp 96 PID 4072 wrote to memory of 1512 4072 3539.tmp 97 PID 4072 wrote to memory of 1512 4072 3539.tmp 97 PID 4072 wrote to memory of 1512 4072 3539.tmp 97 PID 1512 wrote to memory of 5076 1512 35A6.tmp 98 PID 1512 wrote to memory of 5076 1512 35A6.tmp 98 PID 1512 wrote to memory of 5076 1512 35A6.tmp 98 PID 5076 wrote to memory of 4488 5076 3614.tmp 99 PID 5076 wrote to memory of 4488 5076 3614.tmp 99 PID 5076 wrote to memory of 4488 5076 3614.tmp 99 PID 4488 wrote to memory of 3044 4488 3662.tmp 100 PID 4488 wrote to memory of 3044 4488 3662.tmp 100 PID 4488 wrote to memory of 3044 4488 3662.tmp 100 PID 3044 wrote to memory of 2988 3044 36B0.tmp 101 PID 3044 wrote to memory of 2988 3044 36B0.tmp 101 PID 3044 wrote to memory of 2988 3044 36B0.tmp 101 PID 2988 wrote to memory of 4428 2988 371D.tmp 102 PID 2988 wrote to memory of 4428 2988 371D.tmp 102 PID 2988 wrote to memory of 4428 2988 371D.tmp 102 PID 4428 wrote to memory of 5064 4428 377B.tmp 103 PID 4428 wrote to memory of 5064 4428 377B.tmp 103 PID 4428 wrote to memory of 5064 4428 377B.tmp 103 PID 5064 wrote to memory of 3668 5064 37C9.tmp 104 PID 5064 wrote to memory of 3668 5064 37C9.tmp 104 PID 5064 wrote to memory of 3668 5064 37C9.tmp 104 PID 3668 wrote to memory of 4816 3668 3846.tmp 105 PID 3668 wrote to memory of 4816 3668 3846.tmp 105 PID 3668 wrote to memory of 4816 3668 3846.tmp 105 PID 4816 wrote to memory of 4160 4816 38B3.tmp 106 PID 4816 wrote to memory of 4160 4816 38B3.tmp 106 PID 4816 wrote to memory of 4160 4816 38B3.tmp 106 PID 4160 wrote to memory of 4660 4160 3921.tmp 107 PID 4160 wrote to memory of 4660 4160 3921.tmp 107 PID 4160 wrote to memory of 4660 4160 3921.tmp 107 PID 4660 wrote to memory of 776 4660 398E.tmp 108 PID 4660 wrote to memory of 776 4660 398E.tmp 108 PID 4660 wrote to memory of 776 4660 398E.tmp 108 PID 776 wrote to memory of 3620 776 39EC.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_c41d2870262016cd57b7ee9f6d52c6e2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\32C8.tmp"C:\Users\Admin\AppData\Local\Temp\32C8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\34EB.tmp"C:\Users\Admin\AppData\Local\Temp\34EB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"23⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"24⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"25⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"26⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"27⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"28⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"29⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"30⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"31⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"32⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"33⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"34⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"35⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"36⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"37⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"38⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"39⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"40⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"41⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"42⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"43⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"44⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"45⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"46⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"47⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"48⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"49⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"50⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"51⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"52⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"53⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"54⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"55⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"56⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"57⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"58⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"59⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"60⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"61⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"62⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"63⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"64⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"65⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"66⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"67⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"68⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"70⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"71⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"72⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"73⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"74⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"75⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"76⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"77⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"78⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"79⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"80⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"81⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"82⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"83⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"84⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"85⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"86⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"87⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"88⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"89⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"90⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"91⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"92⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"93⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"94⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"95⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"96⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"97⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"98⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"99⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"100⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"101⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"102⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"103⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"104⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"105⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"106⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"107⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"108⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"109⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"110⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"111⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"112⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"113⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"114⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"115⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"116⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"117⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"118⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"119⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"120⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-