Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe
-
Size
488KB
-
MD5
025657c0872bd55bcd0e7f34acaa9aef
-
SHA1
1019b93e31aa9d0a5a6ff30f0f2f77a80a9e56de
-
SHA256
32f43caa1ad36ee434e419c7af659bc80d411233be0da57d021c88074a5386bf
-
SHA512
99b9ae44422566f6690b901f60a18e9e42f7c316327fca2aa423eddb6874917cbd9ec7e7353810b0d82702630fb0c47fcc98bb60e7a4731212cb2efdd722aa15
-
SSDEEP
12288:/U5rCOTeiDQAIF/fHxirnH64twK4LCqhvNZ:/UQOJDMwrna6wK4LPhvN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4084 3374.tmp 3652 33E1.tmp 4552 345E.tmp 4864 34BC.tmp 1932 3529.tmp 4624 3587.tmp 1780 35D5.tmp 4620 3642.tmp 4636 36A0.tmp 4992 370E.tmp 1828 376B.tmp 3548 37D9.tmp 2596 3846.tmp 1496 38A4.tmp 3552 3902.tmp 2552 397F.tmp 320 39FC.tmp 2244 3A69.tmp 2416 3AD6.tmp 4108 3B44.tmp 516 3B92.tmp 2536 3BFF.tmp 2368 3C7C.tmp 4524 3CCA.tmp 3860 3D38.tmp 1988 3DB5.tmp 1712 3E32.tmp 1884 3E80.tmp 2484 3EED.tmp 1524 3F4B.tmp 1952 3FB8.tmp 1772 4006.tmp 3976 4074.tmp 3352 40C2.tmp 4220 412F.tmp 2836 418D.tmp 4216 41DB.tmp 4288 4239.tmp 4392 4297.tmp 4832 42E5.tmp 3568 4343.tmp 1408 4391.tmp 1912 43EE.tmp 224 444C.tmp 3404 449A.tmp 4536 44E8.tmp 4424 4546.tmp 696 4594.tmp 3160 45F2.tmp 1544 465F.tmp 4012 46BD.tmp 3816 470B.tmp 4840 4769.tmp 4532 47C7.tmp 2628 4815.tmp 2324 4863.tmp 4736 48B1.tmp 5116 490F.tmp 2496 496D.tmp 3624 49BB.tmp 440 4A19.tmp 3552 4A67.tmp 3136 4AC4.tmp 1272 4B22.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 752 wrote to memory of 4084 752 2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe 84 PID 752 wrote to memory of 4084 752 2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe 84 PID 752 wrote to memory of 4084 752 2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe 84 PID 4084 wrote to memory of 3652 4084 3374.tmp 85 PID 4084 wrote to memory of 3652 4084 3374.tmp 85 PID 4084 wrote to memory of 3652 4084 3374.tmp 85 PID 3652 wrote to memory of 4552 3652 33E1.tmp 86 PID 3652 wrote to memory of 4552 3652 33E1.tmp 86 PID 3652 wrote to memory of 4552 3652 33E1.tmp 86 PID 4552 wrote to memory of 4864 4552 345E.tmp 89 PID 4552 wrote to memory of 4864 4552 345E.tmp 89 PID 4552 wrote to memory of 4864 4552 345E.tmp 89 PID 4864 wrote to memory of 1932 4864 34BC.tmp 91 PID 4864 wrote to memory of 1932 4864 34BC.tmp 91 PID 4864 wrote to memory of 1932 4864 34BC.tmp 91 PID 1932 wrote to memory of 4624 1932 3529.tmp 92 PID 1932 wrote to memory of 4624 1932 3529.tmp 92 PID 1932 wrote to memory of 4624 1932 3529.tmp 92 PID 4624 wrote to memory of 1780 4624 3587.tmp 93 PID 4624 wrote to memory of 1780 4624 3587.tmp 93 PID 4624 wrote to memory of 1780 4624 3587.tmp 93 PID 1780 wrote to memory of 4620 1780 35D5.tmp 94 PID 1780 wrote to memory of 4620 1780 35D5.tmp 94 PID 1780 wrote to memory of 4620 1780 35D5.tmp 94 PID 4620 wrote to memory of 4636 4620 3642.tmp 95 PID 4620 wrote to memory of 4636 4620 3642.tmp 95 PID 4620 wrote to memory of 4636 4620 3642.tmp 95 PID 4636 wrote to memory of 4992 4636 36A0.tmp 96 PID 4636 wrote to memory of 4992 4636 36A0.tmp 96 PID 4636 wrote to memory of 4992 4636 36A0.tmp 96 PID 4992 wrote to memory of 1828 4992 370E.tmp 97 PID 4992 wrote to memory of 1828 4992 370E.tmp 97 PID 4992 wrote to memory of 1828 4992 370E.tmp 97 PID 1828 wrote to memory of 3548 1828 376B.tmp 98 PID 1828 wrote to memory of 3548 1828 376B.tmp 98 PID 1828 wrote to memory of 3548 1828 376B.tmp 98 PID 3548 wrote to memory of 2596 3548 37D9.tmp 99 PID 3548 wrote to memory of 2596 3548 37D9.tmp 99 PID 3548 wrote to memory of 2596 3548 37D9.tmp 99 PID 2596 wrote to memory of 1496 2596 3846.tmp 100 PID 2596 wrote to memory of 1496 2596 3846.tmp 100 PID 2596 wrote to memory of 1496 2596 3846.tmp 100 PID 1496 wrote to memory of 3552 1496 38A4.tmp 101 PID 1496 wrote to memory of 3552 1496 38A4.tmp 101 PID 1496 wrote to memory of 3552 1496 38A4.tmp 101 PID 3552 wrote to memory of 2552 3552 3902.tmp 102 PID 3552 wrote to memory of 2552 3552 3902.tmp 102 PID 3552 wrote to memory of 2552 3552 3902.tmp 102 PID 2552 wrote to memory of 320 2552 397F.tmp 103 PID 2552 wrote to memory of 320 2552 397F.tmp 103 PID 2552 wrote to memory of 320 2552 397F.tmp 103 PID 320 wrote to memory of 2244 320 39FC.tmp 104 PID 320 wrote to memory of 2244 320 39FC.tmp 104 PID 320 wrote to memory of 2244 320 39FC.tmp 104 PID 2244 wrote to memory of 2416 2244 3A69.tmp 105 PID 2244 wrote to memory of 2416 2244 3A69.tmp 105 PID 2244 wrote to memory of 2416 2244 3A69.tmp 105 PID 2416 wrote to memory of 4108 2416 3AD6.tmp 106 PID 2416 wrote to memory of 4108 2416 3AD6.tmp 106 PID 2416 wrote to memory of 4108 2416 3AD6.tmp 106 PID 4108 wrote to memory of 516 4108 3B44.tmp 107 PID 4108 wrote to memory of 516 4108 3B44.tmp 107 PID 4108 wrote to memory of 516 4108 3B44.tmp 107 PID 516 wrote to memory of 2536 516 3B92.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_025657c0872bd55bcd0e7f34acaa9aef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"23⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"24⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"25⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"26⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"27⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"28⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"29⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"30⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"31⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"32⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"33⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"34⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"35⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"36⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"37⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"38⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"39⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"40⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"41⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"42⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"43⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"44⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"45⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"46⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"47⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"48⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"49⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"50⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"51⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"52⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"53⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"54⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"55⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"56⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"57⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"58⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"59⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"60⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"61⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"62⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"63⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"64⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"65⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"66⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"68⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"69⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"70⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"71⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"72⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"73⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"74⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"75⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"76⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"77⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"78⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"79⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"80⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"81⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"82⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"84⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"85⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"86⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"87⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"88⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"89⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"90⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"91⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"92⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"93⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"94⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"95⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"96⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"97⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"98⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"99⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"100⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"101⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"102⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"103⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"105⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"106⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"107⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"108⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"109⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"110⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"111⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"112⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"113⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"114⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"115⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"116⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"117⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"118⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"119⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"120⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"121⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"122⤵PID:1492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-