Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 15:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe
-
Size
488KB
-
MD5
42dc82b126dd8c1f1f766673dc286c9e
-
SHA1
a6ab76df61d2a71fcdaedd9345000fe458788fb3
-
SHA256
105dbb605532b6eb4673f92c037e98527059fa48c342eac490985c7b34bad6f6
-
SHA512
a02ed7b43426c342296c66127de1b6412414cda4648a9c1c9f4900ec0ed09fff975e8cbe0cd906043c8b94863fe956349c0548793f4fe7d39cd94aca03bf7788
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7X6j1cQsoKqENGFBBMV9CZ9tvHzBZYsQZJHsz:/U5rCOTeiDseQsoK2FvdftrBZYX6NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4676 3D09.tmp 4396 3D67.tmp 1128 3DD4.tmp 4920 3E41.tmp 1288 3EAF.tmp 2272 3EFD.tmp 4776 3F4B.tmp 1748 3F99.tmp 3140 3FE7.tmp 1972 4055.tmp 1408 40B2.tmp 1996 4120.tmp 2072 418D.tmp 2860 41FA.tmp 3960 4258.tmp 4872 42C6.tmp 5008 4323.tmp 3544 4391.tmp 4648 43DF.tmp 2468 445C.tmp 2440 44BA.tmp 4464 4508.tmp 3464 4565.tmp 2772 45B4.tmp 4956 4631.tmp 2768 469E.tmp 3860 470B.tmp 1960 4759.tmp 2556 47C7.tmp 4324 4834.tmp 4424 48A2.tmp 236 48F0.tmp 548 494D.tmp 3844 499C.tmp 3944 49EA.tmp 4312 4A38.tmp 4288 4A96.tmp 1804 4B22.tmp 768 4B70.tmp 3900 4BBE.tmp 1608 4C0D.tmp 4664 4C5B.tmp 1516 4CA9.tmp 4692 4CF7.tmp 1244 4D45.tmp 4168 4DA3.tmp 2568 4DF1.tmp 1820 4E3F.tmp 2272 4E8D.tmp 4532 4EEB.tmp 4508 4F39.tmp 1748 4F87.tmp 4980 4FD5.tmp 5056 5033.tmp 1444 5081.tmp 1408 50DF.tmp 1996 512D.tmp 4720 517B.tmp 1580 51C9.tmp 4040 5217.tmp 3960 5275.tmp 4660 52D3.tmp 5024 5321.tmp 2332 536F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4676 4716 2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe 87 PID 4716 wrote to memory of 4676 4716 2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe 87 PID 4716 wrote to memory of 4676 4716 2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe 87 PID 4676 wrote to memory of 4396 4676 3D09.tmp 88 PID 4676 wrote to memory of 4396 4676 3D09.tmp 88 PID 4676 wrote to memory of 4396 4676 3D09.tmp 88 PID 4396 wrote to memory of 1128 4396 3D67.tmp 89 PID 4396 wrote to memory of 1128 4396 3D67.tmp 89 PID 4396 wrote to memory of 1128 4396 3D67.tmp 89 PID 1128 wrote to memory of 4920 1128 3DD4.tmp 91 PID 1128 wrote to memory of 4920 1128 3DD4.tmp 91 PID 1128 wrote to memory of 4920 1128 3DD4.tmp 91 PID 4920 wrote to memory of 1288 4920 3E41.tmp 92 PID 4920 wrote to memory of 1288 4920 3E41.tmp 92 PID 4920 wrote to memory of 1288 4920 3E41.tmp 92 PID 1288 wrote to memory of 2272 1288 3EAF.tmp 93 PID 1288 wrote to memory of 2272 1288 3EAF.tmp 93 PID 1288 wrote to memory of 2272 1288 3EAF.tmp 93 PID 2272 wrote to memory of 4776 2272 3EFD.tmp 94 PID 2272 wrote to memory of 4776 2272 3EFD.tmp 94 PID 2272 wrote to memory of 4776 2272 3EFD.tmp 94 PID 4776 wrote to memory of 1748 4776 3F4B.tmp 95 PID 4776 wrote to memory of 1748 4776 3F4B.tmp 95 PID 4776 wrote to memory of 1748 4776 3F4B.tmp 95 PID 1748 wrote to memory of 3140 1748 3F99.tmp 96 PID 1748 wrote to memory of 3140 1748 3F99.tmp 96 PID 1748 wrote to memory of 3140 1748 3F99.tmp 96 PID 3140 wrote to memory of 1972 3140 3FE7.tmp 97 PID 3140 wrote to memory of 1972 3140 3FE7.tmp 97 PID 3140 wrote to memory of 1972 3140 3FE7.tmp 97 PID 1972 wrote to memory of 1408 1972 4055.tmp 98 PID 1972 wrote to memory of 1408 1972 4055.tmp 98 PID 1972 wrote to memory of 1408 1972 4055.tmp 98 PID 1408 wrote to memory of 1996 1408 40B2.tmp 99 PID 1408 wrote to memory of 1996 1408 40B2.tmp 99 PID 1408 wrote to memory of 1996 1408 40B2.tmp 99 PID 1996 wrote to memory of 2072 1996 4120.tmp 100 PID 1996 wrote to memory of 2072 1996 4120.tmp 100 PID 1996 wrote to memory of 2072 1996 4120.tmp 100 PID 2072 wrote to memory of 2860 2072 418D.tmp 101 PID 2072 wrote to memory of 2860 2072 418D.tmp 101 PID 2072 wrote to memory of 2860 2072 418D.tmp 101 PID 2860 wrote to memory of 3960 2860 41FA.tmp 102 PID 2860 wrote to memory of 3960 2860 41FA.tmp 102 PID 2860 wrote to memory of 3960 2860 41FA.tmp 102 PID 3960 wrote to memory of 4872 3960 4258.tmp 103 PID 3960 wrote to memory of 4872 3960 4258.tmp 103 PID 3960 wrote to memory of 4872 3960 4258.tmp 103 PID 4872 wrote to memory of 5008 4872 42C6.tmp 104 PID 4872 wrote to memory of 5008 4872 42C6.tmp 104 PID 4872 wrote to memory of 5008 4872 42C6.tmp 104 PID 5008 wrote to memory of 3544 5008 4323.tmp 105 PID 5008 wrote to memory of 3544 5008 4323.tmp 105 PID 5008 wrote to memory of 3544 5008 4323.tmp 105 PID 3544 wrote to memory of 4648 3544 4391.tmp 106 PID 3544 wrote to memory of 4648 3544 4391.tmp 106 PID 3544 wrote to memory of 4648 3544 4391.tmp 106 PID 4648 wrote to memory of 2468 4648 43DF.tmp 107 PID 4648 wrote to memory of 2468 4648 43DF.tmp 107 PID 4648 wrote to memory of 2468 4648 43DF.tmp 107 PID 2468 wrote to memory of 2440 2468 445C.tmp 108 PID 2468 wrote to memory of 2440 2468 445C.tmp 108 PID 2468 wrote to memory of 2440 2468 445C.tmp 108 PID 2440 wrote to memory of 4464 2440 44BA.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_42dc82b126dd8c1f1f766673dc286c9e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"23⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"24⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"25⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"26⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"27⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"28⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"29⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"30⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"31⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"32⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"33⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"34⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"35⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"36⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"37⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"38⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"39⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"40⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"41⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"42⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"43⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"44⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"45⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"46⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"47⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"48⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"49⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"50⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"51⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"52⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"53⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"54⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"55⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"56⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"58⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"59⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"60⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"61⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"62⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"63⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"64⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"65⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"66⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"67⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"68⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"69⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"70⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"71⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"72⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"73⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"74⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"75⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"76⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"77⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"79⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"80⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"81⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"82⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"83⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"84⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"85⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"86⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"87⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"88⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"89⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"90⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"91⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"92⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"93⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"94⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"95⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"96⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"97⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"99⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"100⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"101⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"102⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"103⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"104⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"105⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"106⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"107⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"108⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"109⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"110⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"111⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"112⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"113⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"114⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"115⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"116⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"117⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"118⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"119⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"120⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"121⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"122⤵PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-