Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 12:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe
-
Size
486KB
-
MD5
8a7635a447c296aa5d83b52ba37255df
-
SHA1
ad1ee876ce1d47f1ab9bf53ff3d2bcdec58eb0df
-
SHA256
46cf595c674ff2b3367971375a77817876f3a0457aa07cf6cbf6d3dfd38bca3a
-
SHA512
864aca639b613ff4df91599436e39cfe5cb3593a702607f613fadbe238bae3863e783764590fc54f882d931161136edf4307b75268b5dc8ffca29f545aa153b1
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJ7Dnhr6m/mAOZcuEkWiLoRZybd9tWk8cpw5aF:/U5rCOTeiDZDnhWanJR8oKA4piH
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4144 3AF6.tmp 4572 3B73.tmp 1936 3BE0.tmp 3128 3C5D.tmp 4848 3CCA.tmp 2492 3D57.tmp 2880 3DC4.tmp 1332 3E22.tmp 3352 3E70.tmp 372 3ECE.tmp 4472 3F1C.tmp 4960 3F89.tmp 840 3FD8.tmp 4148 4045.tmp 4156 40B2.tmp 4792 4120.tmp 2428 418D.tmp 1040 41FA.tmp 4272 4268.tmp 3604 42C6.tmp 4496 4333.tmp 1020 4381.tmp 2660 442D.tmp 4100 448B.tmp 4664 44F8.tmp 3148 4565.tmp 1340 45B4.tmp 1948 4611.tmp 3984 465F.tmp 2340 46AE.tmp 3992 471B.tmp 3404 4769.tmp 2628 47C7.tmp 2632 4815.tmp 452 4873.tmp 2620 48F0.tmp 4368 499C.tmp 4844 49EA.tmp 4076 4A38.tmp 4008 4A96.tmp 4824 4AE4.tmp 4604 4B32.tmp 976 4B90.tmp 5112 4BDE.tmp 4780 4C2C.tmp 2044 4C8A.tmp 4848 4CD8.tmp 64 4D26.tmp 4908 4D74.tmp 5000 4DC2.tmp 4548 4E20.tmp 3456 4E6E.tmp 3972 4EBC.tmp 3352 4F0A.tmp 4860 4F68.tmp 2384 4FC6.tmp 404 5014.tmp 4736 5062.tmp 3884 50B0.tmp 1328 50FE.tmp 4148 515C.tmp 656 51BA.tmp 2016 5217.tmp 1456 5266.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 4144 640 2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe 84 PID 640 wrote to memory of 4144 640 2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe 84 PID 640 wrote to memory of 4144 640 2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe 84 PID 4144 wrote to memory of 4572 4144 3AF6.tmp 85 PID 4144 wrote to memory of 4572 4144 3AF6.tmp 85 PID 4144 wrote to memory of 4572 4144 3AF6.tmp 85 PID 4572 wrote to memory of 1936 4572 3B73.tmp 86 PID 4572 wrote to memory of 1936 4572 3B73.tmp 86 PID 4572 wrote to memory of 1936 4572 3B73.tmp 86 PID 1936 wrote to memory of 3128 1936 3BE0.tmp 87 PID 1936 wrote to memory of 3128 1936 3BE0.tmp 87 PID 1936 wrote to memory of 3128 1936 3BE0.tmp 87 PID 3128 wrote to memory of 4848 3128 3C5D.tmp 89 PID 3128 wrote to memory of 4848 3128 3C5D.tmp 89 PID 3128 wrote to memory of 4848 3128 3C5D.tmp 89 PID 4848 wrote to memory of 2492 4848 3CCA.tmp 92 PID 4848 wrote to memory of 2492 4848 3CCA.tmp 92 PID 4848 wrote to memory of 2492 4848 3CCA.tmp 92 PID 2492 wrote to memory of 2880 2492 3D57.tmp 93 PID 2492 wrote to memory of 2880 2492 3D57.tmp 93 PID 2492 wrote to memory of 2880 2492 3D57.tmp 93 PID 2880 wrote to memory of 1332 2880 3DC4.tmp 94 PID 2880 wrote to memory of 1332 2880 3DC4.tmp 94 PID 2880 wrote to memory of 1332 2880 3DC4.tmp 94 PID 1332 wrote to memory of 3352 1332 3E22.tmp 95 PID 1332 wrote to memory of 3352 1332 3E22.tmp 95 PID 1332 wrote to memory of 3352 1332 3E22.tmp 95 PID 3352 wrote to memory of 372 3352 3E70.tmp 96 PID 3352 wrote to memory of 372 3352 3E70.tmp 96 PID 3352 wrote to memory of 372 3352 3E70.tmp 96 PID 372 wrote to memory of 4472 372 3ECE.tmp 97 PID 372 wrote to memory of 4472 372 3ECE.tmp 97 PID 372 wrote to memory of 4472 372 3ECE.tmp 97 PID 4472 wrote to memory of 4960 4472 3F1C.tmp 98 PID 4472 wrote to memory of 4960 4472 3F1C.tmp 98 PID 4472 wrote to memory of 4960 4472 3F1C.tmp 98 PID 4960 wrote to memory of 840 4960 3F89.tmp 99 PID 4960 wrote to memory of 840 4960 3F89.tmp 99 PID 4960 wrote to memory of 840 4960 3F89.tmp 99 PID 840 wrote to memory of 4148 840 3FD8.tmp 100 PID 840 wrote to memory of 4148 840 3FD8.tmp 100 PID 840 wrote to memory of 4148 840 3FD8.tmp 100 PID 4148 wrote to memory of 4156 4148 4045.tmp 101 PID 4148 wrote to memory of 4156 4148 4045.tmp 101 PID 4148 wrote to memory of 4156 4148 4045.tmp 101 PID 4156 wrote to memory of 4792 4156 40B2.tmp 102 PID 4156 wrote to memory of 4792 4156 40B2.tmp 102 PID 4156 wrote to memory of 4792 4156 40B2.tmp 102 PID 4792 wrote to memory of 2428 4792 4120.tmp 103 PID 4792 wrote to memory of 2428 4792 4120.tmp 103 PID 4792 wrote to memory of 2428 4792 4120.tmp 103 PID 2428 wrote to memory of 1040 2428 418D.tmp 104 PID 2428 wrote to memory of 1040 2428 418D.tmp 104 PID 2428 wrote to memory of 1040 2428 418D.tmp 104 PID 1040 wrote to memory of 4272 1040 41FA.tmp 105 PID 1040 wrote to memory of 4272 1040 41FA.tmp 105 PID 1040 wrote to memory of 4272 1040 41FA.tmp 105 PID 4272 wrote to memory of 3604 4272 4268.tmp 106 PID 4272 wrote to memory of 3604 4272 4268.tmp 106 PID 4272 wrote to memory of 3604 4272 4268.tmp 106 PID 3604 wrote to memory of 4496 3604 42C6.tmp 107 PID 3604 wrote to memory of 4496 3604 42C6.tmp 107 PID 3604 wrote to memory of 4496 3604 42C6.tmp 107 PID 4496 wrote to memory of 1020 4496 4333.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_8a7635a447c296aa5d83b52ba37255df_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"23⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"24⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"25⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"26⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"27⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"28⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"29⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"30⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"31⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"32⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"33⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"34⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"35⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"36⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"37⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"38⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"39⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"40⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"41⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"42⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"43⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"44⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"45⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"46⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"47⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"48⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"49⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"50⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"51⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"52⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"53⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"54⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"55⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"56⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"57⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"58⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"59⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"60⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"61⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"62⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"63⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"64⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"65⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"66⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"68⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"69⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"70⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"72⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"73⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"74⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"75⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"76⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"77⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"78⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"79⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"80⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"81⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"82⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"83⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"84⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"85⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"86⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"87⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"88⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"89⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"90⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"91⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"93⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"94⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"95⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"96⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"97⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"98⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"99⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"100⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"101⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"102⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"103⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"104⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"105⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"106⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"107⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"108⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"109⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"110⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"111⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"112⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"113⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"114⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"115⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"116⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"117⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"118⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"119⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"120⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"121⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"122⤵PID:1492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-