Analysis
-
max time kernel
150s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 19:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe
-
Size
712KB
-
MD5
e82cc5bb6efbf21aa399039b55ec6f2b
-
SHA1
50354ea14301093477efe7e455f0028da4a3386f
-
SHA256
9546e0f5e399109e61c04c83e8b8e8973a7710c862446fefc6de857123f1bf95
-
SHA512
5188645df9e291a272b829bad3107f12162c36c94c14372b6280c9e62da49364873f53172f0b2cbc6e57e386a2763404e25f15ef9fa4840d9f11dbe9ae442cc1
-
SSDEEP
12288:FU5rCOTeiDk6IUNX7JrHaSIEnpAHbDd1fFNZdCvq5TJLCvY90D8/LVBlVk736Y7k:FUQOJD1RI4p2bDddFNnCvq5TJLCvY90E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4544 2F7C.tmp 2204 3028.tmp 2180 3095.tmp 8 3103.tmp 3132 3180.tmp 4328 31ED.tmp 4884 325A.tmp 4480 32F7.tmp 1564 3374.tmp 2348 3410.tmp 2548 347D.tmp 2792 34FA.tmp 5028 3568.tmp 2484 35C5.tmp 4296 3642.tmp 764 36CF.tmp 1288 375C.tmp 3216 37D9.tmp 2272 3865.tmp 936 38F2.tmp 2364 398E.tmp 1524 39EC.tmp 768 3A69.tmp 3136 3AD6.tmp 4244 3B63.tmp 4840 3BD0.tmp 2160 3C1E.tmp 2092 3CAB.tmp 4800 3D47.tmp 4028 3DB5.tmp 4240 3E32.tmp 1224 3EBE.tmp 888 3F4B.tmp 2412 3F99.tmp 4372 3FF7.tmp 1624 4055.tmp 1944 40A3.tmp 452 4100.tmp 2564 414F.tmp 4512 419D.tmp 920 41EB.tmp 4472 4249.tmp 4428 4297.tmp 3688 42F4.tmp 5032 4352.tmp 4928 43A0.tmp 744 43EE.tmp 2652 443D.tmp 5044 449A.tmp 2776 44F8.tmp 3992 4546.tmp 1604 4594.tmp 2068 45F2.tmp 724 4650.tmp 3732 46AE.tmp 2832 46FC.tmp 976 4759.tmp 4024 47A8.tmp 3276 47F6.tmp 4480 4853.tmp 1564 48A2.tmp 3272 490F.tmp 4856 495D.tmp 2548 49AB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 4544 3192 2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe 85 PID 3192 wrote to memory of 4544 3192 2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe 85 PID 3192 wrote to memory of 4544 3192 2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe 85 PID 4544 wrote to memory of 2204 4544 2F7C.tmp 86 PID 4544 wrote to memory of 2204 4544 2F7C.tmp 86 PID 4544 wrote to memory of 2204 4544 2F7C.tmp 86 PID 2204 wrote to memory of 2180 2204 3028.tmp 87 PID 2204 wrote to memory of 2180 2204 3028.tmp 87 PID 2204 wrote to memory of 2180 2204 3028.tmp 87 PID 2180 wrote to memory of 8 2180 3095.tmp 89 PID 2180 wrote to memory of 8 2180 3095.tmp 89 PID 2180 wrote to memory of 8 2180 3095.tmp 89 PID 8 wrote to memory of 3132 8 3103.tmp 91 PID 8 wrote to memory of 3132 8 3103.tmp 91 PID 8 wrote to memory of 3132 8 3103.tmp 91 PID 3132 wrote to memory of 4328 3132 3180.tmp 93 PID 3132 wrote to memory of 4328 3132 3180.tmp 93 PID 3132 wrote to memory of 4328 3132 3180.tmp 93 PID 4328 wrote to memory of 4884 4328 31ED.tmp 94 PID 4328 wrote to memory of 4884 4328 31ED.tmp 94 PID 4328 wrote to memory of 4884 4328 31ED.tmp 94 PID 4884 wrote to memory of 4480 4884 325A.tmp 95 PID 4884 wrote to memory of 4480 4884 325A.tmp 95 PID 4884 wrote to memory of 4480 4884 325A.tmp 95 PID 4480 wrote to memory of 1564 4480 32F7.tmp 96 PID 4480 wrote to memory of 1564 4480 32F7.tmp 96 PID 4480 wrote to memory of 1564 4480 32F7.tmp 96 PID 1564 wrote to memory of 2348 1564 3374.tmp 97 PID 1564 wrote to memory of 2348 1564 3374.tmp 97 PID 1564 wrote to memory of 2348 1564 3374.tmp 97 PID 2348 wrote to memory of 2548 2348 3410.tmp 98 PID 2348 wrote to memory of 2548 2348 3410.tmp 98 PID 2348 wrote to memory of 2548 2348 3410.tmp 98 PID 2548 wrote to memory of 2792 2548 347D.tmp 99 PID 2548 wrote to memory of 2792 2548 347D.tmp 99 PID 2548 wrote to memory of 2792 2548 347D.tmp 99 PID 2792 wrote to memory of 5028 2792 34FA.tmp 100 PID 2792 wrote to memory of 5028 2792 34FA.tmp 100 PID 2792 wrote to memory of 5028 2792 34FA.tmp 100 PID 5028 wrote to memory of 2484 5028 3568.tmp 101 PID 5028 wrote to memory of 2484 5028 3568.tmp 101 PID 5028 wrote to memory of 2484 5028 3568.tmp 101 PID 2484 wrote to memory of 4296 2484 35C5.tmp 102 PID 2484 wrote to memory of 4296 2484 35C5.tmp 102 PID 2484 wrote to memory of 4296 2484 35C5.tmp 102 PID 4296 wrote to memory of 764 4296 3642.tmp 103 PID 4296 wrote to memory of 764 4296 3642.tmp 103 PID 4296 wrote to memory of 764 4296 3642.tmp 103 PID 764 wrote to memory of 1288 764 36CF.tmp 104 PID 764 wrote to memory of 1288 764 36CF.tmp 104 PID 764 wrote to memory of 1288 764 36CF.tmp 104 PID 1288 wrote to memory of 3216 1288 375C.tmp 105 PID 1288 wrote to memory of 3216 1288 375C.tmp 105 PID 1288 wrote to memory of 3216 1288 375C.tmp 105 PID 3216 wrote to memory of 2272 3216 37D9.tmp 106 PID 3216 wrote to memory of 2272 3216 37D9.tmp 106 PID 3216 wrote to memory of 2272 3216 37D9.tmp 106 PID 2272 wrote to memory of 936 2272 3865.tmp 107 PID 2272 wrote to memory of 936 2272 3865.tmp 107 PID 2272 wrote to memory of 936 2272 3865.tmp 107 PID 936 wrote to memory of 2364 936 38F2.tmp 108 PID 936 wrote to memory of 2364 936 38F2.tmp 108 PID 936 wrote to memory of 2364 936 38F2.tmp 108 PID 2364 wrote to memory of 1524 2364 398E.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_e82cc5bb6efbf21aa399039b55ec6f2b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"C:\Users\Admin\AppData\Local\Temp\2F7C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3095.tmp"C:\Users\Admin\AppData\Local\Temp\3095.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3103.tmp"C:\Users\Admin\AppData\Local\Temp\3103.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"23⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"24⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"25⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"26⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"27⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"28⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"29⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"30⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"31⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"32⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"33⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"34⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"35⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"36⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"37⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"38⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"39⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"40⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"41⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"42⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"43⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"44⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"45⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"48⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"49⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"50⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"51⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"52⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"53⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"54⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"55⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"56⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"57⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"58⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"59⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"60⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"62⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"63⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"64⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"65⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"66⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"67⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"68⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"69⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"70⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"71⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"73⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"74⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"75⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"76⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"77⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"78⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"79⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"80⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"81⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"82⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"83⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"84⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"85⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"86⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"87⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"88⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"89⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"90⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"91⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"92⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"93⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"94⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"95⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"96⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"97⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"98⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"99⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"100⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"101⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"102⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"103⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"105⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"106⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"107⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"108⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"109⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"110⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"111⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"112⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"113⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"114⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"115⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"116⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"117⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"118⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"119⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"120⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"121⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"122⤵PID:4724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-