Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 18:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe
-
Size
541KB
-
MD5
a24ef215cc2827c494281d37d64d49d1
-
SHA1
7a00ae95905ba01731c81024e0ed3d5223581c3d
-
SHA256
5228306310e25e3666700552c30586fca032bc41ef4d90b5722a04635dd66ae5
-
SHA512
5f0ac0765ab663a02c5d5e2a344d0209b8fc5604a14d724523a2a960cfd07cc057e625ff7ac668187dae34b362b3a9e0c88ed082fc053c5ee628f792e3ddc4ff
-
SSDEEP
12288:UU5rCOTeif08aC8WQ+/tcv6IdqWrZa73ctO:UUQOJffeWQaCvvqWrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2676 3306.tmp 2732 3374.tmp 4720 33E1.tmp 3280 344E.tmp 1344 34CB.tmp 4304 3548.tmp 4608 35B6.tmp 392 3604.tmp 2936 3652.tmp 3168 36A0.tmp 2324 36FE.tmp 396 375C.tmp 1576 37AA.tmp 2460 3827.tmp 3800 38A4.tmp 1628 3921.tmp 5036 398E.tmp 3424 39DC.tmp 1196 3A2A.tmp 2436 3A88.tmp 5032 3B05.tmp 1144 3B73.tmp 3624 3C1E.tmp 4008 3C6D.tmp 2084 3CBB.tmp 1236 3D18.tmp 1980 3D67.tmp 4708 3DB5.tmp 4164 3E32.tmp 3712 3EAF.tmp 912 3F1C.tmp 1644 3F6A.tmp 1048 3FC8.tmp 4440 4016.tmp 4404 4064.tmp 1364 40C2.tmp 4456 4120.tmp 1360 416E.tmp 4384 41BC.tmp 4408 420A.tmp 4396 4258.tmp 4492 42A6.tmp 2792 42F4.tmp 5064 4352.tmp 2424 43A0.tmp 3000 43EE.tmp 5080 443D.tmp 3252 449A.tmp 4888 44E8.tmp 1696 4537.tmp 2632 4594.tmp 4596 45E2.tmp 1528 4631.tmp 2112 467F.tmp 4700 46CD.tmp 4324 472B.tmp 3444 4779.tmp 4336 47D6.tmp 2184 4825.tmp 3992 4873.tmp 3168 48C1.tmp 2908 490F.tmp 3108 496D.tmp 3236 49BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4492 wrote to memory of 2676 4492 2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe 81 PID 4492 wrote to memory of 2676 4492 2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe 81 PID 4492 wrote to memory of 2676 4492 2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe 81 PID 2676 wrote to memory of 2732 2676 3306.tmp 82 PID 2676 wrote to memory of 2732 2676 3306.tmp 82 PID 2676 wrote to memory of 2732 2676 3306.tmp 82 PID 2732 wrote to memory of 4720 2732 3374.tmp 83 PID 2732 wrote to memory of 4720 2732 3374.tmp 83 PID 2732 wrote to memory of 4720 2732 3374.tmp 83 PID 4720 wrote to memory of 3280 4720 33E1.tmp 85 PID 4720 wrote to memory of 3280 4720 33E1.tmp 85 PID 4720 wrote to memory of 3280 4720 33E1.tmp 85 PID 3280 wrote to memory of 1344 3280 344E.tmp 87 PID 3280 wrote to memory of 1344 3280 344E.tmp 87 PID 3280 wrote to memory of 1344 3280 344E.tmp 87 PID 1344 wrote to memory of 4304 1344 34CB.tmp 89 PID 1344 wrote to memory of 4304 1344 34CB.tmp 89 PID 1344 wrote to memory of 4304 1344 34CB.tmp 89 PID 4304 wrote to memory of 4608 4304 3548.tmp 91 PID 4304 wrote to memory of 4608 4304 3548.tmp 91 PID 4304 wrote to memory of 4608 4304 3548.tmp 91 PID 4608 wrote to memory of 392 4608 35B6.tmp 92 PID 4608 wrote to memory of 392 4608 35B6.tmp 92 PID 4608 wrote to memory of 392 4608 35B6.tmp 92 PID 392 wrote to memory of 2936 392 3604.tmp 93 PID 392 wrote to memory of 2936 392 3604.tmp 93 PID 392 wrote to memory of 2936 392 3604.tmp 93 PID 2936 wrote to memory of 3168 2936 3652.tmp 94 PID 2936 wrote to memory of 3168 2936 3652.tmp 94 PID 2936 wrote to memory of 3168 2936 3652.tmp 94 PID 3168 wrote to memory of 2324 3168 36A0.tmp 95 PID 3168 wrote to memory of 2324 3168 36A0.tmp 95 PID 3168 wrote to memory of 2324 3168 36A0.tmp 95 PID 2324 wrote to memory of 396 2324 36FE.tmp 96 PID 2324 wrote to memory of 396 2324 36FE.tmp 96 PID 2324 wrote to memory of 396 2324 36FE.tmp 96 PID 396 wrote to memory of 1576 396 375C.tmp 97 PID 396 wrote to memory of 1576 396 375C.tmp 97 PID 396 wrote to memory of 1576 396 375C.tmp 97 PID 1576 wrote to memory of 2460 1576 37AA.tmp 98 PID 1576 wrote to memory of 2460 1576 37AA.tmp 98 PID 1576 wrote to memory of 2460 1576 37AA.tmp 98 PID 2460 wrote to memory of 3800 2460 3827.tmp 99 PID 2460 wrote to memory of 3800 2460 3827.tmp 99 PID 2460 wrote to memory of 3800 2460 3827.tmp 99 PID 3800 wrote to memory of 1628 3800 38A4.tmp 100 PID 3800 wrote to memory of 1628 3800 38A4.tmp 100 PID 3800 wrote to memory of 1628 3800 38A4.tmp 100 PID 1628 wrote to memory of 5036 1628 3921.tmp 101 PID 1628 wrote to memory of 5036 1628 3921.tmp 101 PID 1628 wrote to memory of 5036 1628 3921.tmp 101 PID 5036 wrote to memory of 3424 5036 398E.tmp 102 PID 5036 wrote to memory of 3424 5036 398E.tmp 102 PID 5036 wrote to memory of 3424 5036 398E.tmp 102 PID 3424 wrote to memory of 1196 3424 39DC.tmp 103 PID 3424 wrote to memory of 1196 3424 39DC.tmp 103 PID 3424 wrote to memory of 1196 3424 39DC.tmp 103 PID 1196 wrote to memory of 2436 1196 3A2A.tmp 104 PID 1196 wrote to memory of 2436 1196 3A2A.tmp 104 PID 1196 wrote to memory of 2436 1196 3A2A.tmp 104 PID 2436 wrote to memory of 5032 2436 3A88.tmp 105 PID 2436 wrote to memory of 5032 2436 3A88.tmp 105 PID 2436 wrote to memory of 5032 2436 3A88.tmp 105 PID 5032 wrote to memory of 1144 5032 3B05.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_a24ef215cc2827c494281d37d64d49d1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"23⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"24⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"25⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"26⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"27⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"28⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"29⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"30⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"31⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"32⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"33⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"34⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"35⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"36⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"37⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"38⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"39⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"40⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"41⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"42⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"43⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"44⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"45⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"46⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"47⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"48⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"49⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"50⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"51⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"52⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"53⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"54⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"55⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"56⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"57⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"58⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"59⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"60⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"61⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"62⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"63⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"64⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"65⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"67⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"68⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"69⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"71⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"72⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"73⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"74⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"75⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"76⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"77⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"78⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"79⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"80⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"81⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"82⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"83⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"84⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"85⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"86⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"87⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"88⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"89⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"90⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"91⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"92⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"93⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"94⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"95⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"96⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"97⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"98⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"99⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"100⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"101⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"102⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"103⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"104⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"105⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"106⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"107⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"108⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"109⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"110⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"111⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"112⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"113⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"114⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"115⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"116⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"117⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"118⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"119⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"120⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"121⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"122⤵PID:2032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-