Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 05:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe
-
Size
486KB
-
MD5
69be821901883f5908a460873c24fa23
-
SHA1
3cbeae53670919e88e3642e5cc7841e54262b942
-
SHA256
0daa09fa47cad3f2f1e5c072be82ee292a0267d52f548bde316fa99933b101d6
-
SHA512
07a2c3f270f69e7d66b0bf5a80ecf9e1e4892c99b2fcebdccae5a324e86c87d7f5681367d90c1226712f27997e1bbca56c71d7dc625d604636b4110b1fcaffef
-
SSDEEP
12288:UU5rCOTeiDiHqxzdxLSUwK6mmLWqmk9JyKU6HnNZ:UUQOJDiHizdQUhymKDtHnN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2400 2EC1.tmp 4752 2F1E.tmp 3584 2F7C.tmp 2924 2FF9.tmp 2088 3066.tmp 2240 30D4.tmp 1828 3132.tmp 4092 318F.tmp 3184 31ED.tmp 4068 325A.tmp 3164 32A9.tmp 1844 3316.tmp 3752 3374.tmp 4376 33F1.tmp 2312 343F.tmp 4432 34BC.tmp 3000 351A.tmp 5020 3587.tmp 2856 35E5.tmp 3504 3662.tmp 2576 36B0.tmp 1784 370E.tmp 2352 376B.tmp 448 37D9.tmp 4640 3827.tmp 1792 3894.tmp 4524 38F2.tmp 2984 395F.tmp 4508 39CD.tmp 4556 3A2A.tmp 700 3A98.tmp 4892 3B05.tmp 2944 3B63.tmp 3236 3BB1.tmp 1620 3BFF.tmp 1528 3C4D.tmp 4092 3C9B.tmp 452 3CEA.tmp 2968 3D38.tmp 4740 3D86.tmp 2360 3DD4.tmp 4376 3E22.tmp 5116 3E70.tmp 1608 3EBE.tmp 4836 3F0C.tmp 1012 3F5B.tmp 3504 3FB8.tmp 2224 4006.tmp 2292 4064.tmp 1344 40B2.tmp 4264 4110.tmp 2324 415E.tmp 3280 41AC.tmp 732 420A.tmp 1096 4258.tmp 388 42A6.tmp 4664 42F4.tmp 1440 4343.tmp 4340 43A0.tmp 4408 43EE.tmp 2400 443D.tmp 1668 449A.tmp 3360 44F8.tmp 4144 4556.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3748 wrote to memory of 2400 3748 2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe 86 PID 3748 wrote to memory of 2400 3748 2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe 86 PID 3748 wrote to memory of 2400 3748 2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe 86 PID 2400 wrote to memory of 4752 2400 2EC1.tmp 87 PID 2400 wrote to memory of 4752 2400 2EC1.tmp 87 PID 2400 wrote to memory of 4752 2400 2EC1.tmp 87 PID 4752 wrote to memory of 3584 4752 2F1E.tmp 88 PID 4752 wrote to memory of 3584 4752 2F1E.tmp 88 PID 4752 wrote to memory of 3584 4752 2F1E.tmp 88 PID 3584 wrote to memory of 2924 3584 2F7C.tmp 90 PID 3584 wrote to memory of 2924 3584 2F7C.tmp 90 PID 3584 wrote to memory of 2924 3584 2F7C.tmp 90 PID 2924 wrote to memory of 2088 2924 2FF9.tmp 92 PID 2924 wrote to memory of 2088 2924 2FF9.tmp 92 PID 2924 wrote to memory of 2088 2924 2FF9.tmp 92 PID 2088 wrote to memory of 2240 2088 3066.tmp 93 PID 2088 wrote to memory of 2240 2088 3066.tmp 93 PID 2088 wrote to memory of 2240 2088 3066.tmp 93 PID 2240 wrote to memory of 1828 2240 30D4.tmp 94 PID 2240 wrote to memory of 1828 2240 30D4.tmp 94 PID 2240 wrote to memory of 1828 2240 30D4.tmp 94 PID 1828 wrote to memory of 4092 1828 3132.tmp 96 PID 1828 wrote to memory of 4092 1828 3132.tmp 96 PID 1828 wrote to memory of 4092 1828 3132.tmp 96 PID 4092 wrote to memory of 3184 4092 318F.tmp 97 PID 4092 wrote to memory of 3184 4092 318F.tmp 97 PID 4092 wrote to memory of 3184 4092 318F.tmp 97 PID 3184 wrote to memory of 4068 3184 31ED.tmp 98 PID 3184 wrote to memory of 4068 3184 31ED.tmp 98 PID 3184 wrote to memory of 4068 3184 31ED.tmp 98 PID 4068 wrote to memory of 3164 4068 325A.tmp 99 PID 4068 wrote to memory of 3164 4068 325A.tmp 99 PID 4068 wrote to memory of 3164 4068 325A.tmp 99 PID 3164 wrote to memory of 1844 3164 32A9.tmp 100 PID 3164 wrote to memory of 1844 3164 32A9.tmp 100 PID 3164 wrote to memory of 1844 3164 32A9.tmp 100 PID 1844 wrote to memory of 3752 1844 3316.tmp 101 PID 1844 wrote to memory of 3752 1844 3316.tmp 101 PID 1844 wrote to memory of 3752 1844 3316.tmp 101 PID 3752 wrote to memory of 4376 3752 3374.tmp 102 PID 3752 wrote to memory of 4376 3752 3374.tmp 102 PID 3752 wrote to memory of 4376 3752 3374.tmp 102 PID 4376 wrote to memory of 2312 4376 33F1.tmp 103 PID 4376 wrote to memory of 2312 4376 33F1.tmp 103 PID 4376 wrote to memory of 2312 4376 33F1.tmp 103 PID 2312 wrote to memory of 4432 2312 343F.tmp 104 PID 2312 wrote to memory of 4432 2312 343F.tmp 104 PID 2312 wrote to memory of 4432 2312 343F.tmp 104 PID 4432 wrote to memory of 3000 4432 34BC.tmp 105 PID 4432 wrote to memory of 3000 4432 34BC.tmp 105 PID 4432 wrote to memory of 3000 4432 34BC.tmp 105 PID 3000 wrote to memory of 5020 3000 351A.tmp 106 PID 3000 wrote to memory of 5020 3000 351A.tmp 106 PID 3000 wrote to memory of 5020 3000 351A.tmp 106 PID 5020 wrote to memory of 2856 5020 3587.tmp 107 PID 5020 wrote to memory of 2856 5020 3587.tmp 107 PID 5020 wrote to memory of 2856 5020 3587.tmp 107 PID 2856 wrote to memory of 3504 2856 35E5.tmp 108 PID 2856 wrote to memory of 3504 2856 35E5.tmp 108 PID 2856 wrote to memory of 3504 2856 35E5.tmp 108 PID 3504 wrote to memory of 2576 3504 3662.tmp 109 PID 3504 wrote to memory of 2576 3504 3662.tmp 109 PID 3504 wrote to memory of 2576 3504 3662.tmp 109 PID 2576 wrote to memory of 1784 2576 36B0.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_69be821901883f5908a460873c24fa23_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3066.tmp"C:\Users\Admin\AppData\Local\Temp\3066.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\30D4.tmp"C:\Users\Admin\AppData\Local\Temp\30D4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"23⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"24⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"25⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"26⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"27⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"28⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"29⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"30⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"31⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"32⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"33⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"34⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"35⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"36⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"37⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"38⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"39⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"40⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"41⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"42⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"43⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"44⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"45⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"46⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"47⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"48⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"49⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"50⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"51⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"52⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"53⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"54⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"55⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"56⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"57⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"58⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"59⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"60⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"61⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"62⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"63⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"64⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"65⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"66⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"67⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"68⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"69⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"70⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"71⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"72⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"73⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"74⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"75⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"76⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"77⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"78⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"80⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"81⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"82⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"83⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"84⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"85⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"86⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"87⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"88⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"89⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"90⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"91⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"92⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"93⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"94⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"95⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"96⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"97⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"98⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"99⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"100⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"101⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"102⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"103⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"104⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"105⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"106⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"107⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"108⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"109⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"110⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"111⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"112⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"113⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"114⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"115⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"116⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"117⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"119⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"120⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"121⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-