Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe
-
Size
487KB
-
MD5
392da5afb00939a6f56c92247a6b9fb8
-
SHA1
dd8e2b6c7409776a393758851d5e6cace56869bf
-
SHA256
7b7a2fda1f07187b03a37b01cd8c453edfbc6177338d9265e1a7089712ccd063
-
SHA512
45fbd15eec29de7f05c6e3e47e83683bd043368a22d9fe17d5bf12a278b41854a18f7574a655805af0fe38eae5e9bb9b4388fc612d6ec1f4b0f9f14ce9f3352a
-
SSDEEP
12288:HU5rCOTeiJ7kWjVuE9hkUKOgeL4djdLNZ:HUQOJJ7kWjUW+FuMHLN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4164 2DF5.tmp 3820 2E53.tmp 2888 2EC1.tmp 3992 2F4D.tmp 1924 2FAB.tmp 1988 2FF9.tmp 3700 3057.tmp 1528 30A5.tmp 1440 30F3.tmp 2044 3170.tmp 4016 31BE.tmp 3308 323B.tmp 2128 3289.tmp 3512 32D7.tmp 1160 3326.tmp 1636 3383.tmp 2700 33F1.tmp 3580 343F.tmp 3808 34AC.tmp 1520 34FA.tmp 3916 3568.tmp 2624 35B6.tmp 1340 3614.tmp 4712 3681.tmp 4744 36CF.tmp 2620 371D.tmp 4552 376B.tmp 2352 37E8.tmp 632 3836.tmp 4572 3885.tmp 3372 38D3.tmp 4836 3940.tmp 1004 399E.tmp 852 39EC.tmp 2320 3A3A.tmp 2172 3A88.tmp 392 3AD6.tmp 1456 3B34.tmp 400 3B82.tmp 4840 3BD0.tmp 4372 3C1E.tmp 3152 3C6D.tmp 3632 3CCA.tmp 716 3D28.tmp 2416 3D76.tmp 2944 3DD4.tmp 2916 3E32.tmp 3500 3E80.tmp 3064 3ECE.tmp 3516 3F1C.tmp 4476 3F7A.tmp 3964 3FD8.tmp 3720 4026.tmp 1440 4074.tmp 5052 40C2.tmp 3900 4110.tmp 3988 417D.tmp 3308 41DB.tmp 2420 4229.tmp 4484 4287.tmp 3216 42E5.tmp 4760 4333.tmp 4732 4381.tmp 4896 43C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4164 4940 2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe 82 PID 4940 wrote to memory of 4164 4940 2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe 82 PID 4940 wrote to memory of 4164 4940 2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe 82 PID 4164 wrote to memory of 3820 4164 2DF5.tmp 83 PID 4164 wrote to memory of 3820 4164 2DF5.tmp 83 PID 4164 wrote to memory of 3820 4164 2DF5.tmp 83 PID 3820 wrote to memory of 2888 3820 2E53.tmp 85 PID 3820 wrote to memory of 2888 3820 2E53.tmp 85 PID 3820 wrote to memory of 2888 3820 2E53.tmp 85 PID 2888 wrote to memory of 3992 2888 2EC1.tmp 87 PID 2888 wrote to memory of 3992 2888 2EC1.tmp 87 PID 2888 wrote to memory of 3992 2888 2EC1.tmp 87 PID 3992 wrote to memory of 1924 3992 2F4D.tmp 89 PID 3992 wrote to memory of 1924 3992 2F4D.tmp 89 PID 3992 wrote to memory of 1924 3992 2F4D.tmp 89 PID 1924 wrote to memory of 1988 1924 2FAB.tmp 90 PID 1924 wrote to memory of 1988 1924 2FAB.tmp 90 PID 1924 wrote to memory of 1988 1924 2FAB.tmp 90 PID 1988 wrote to memory of 3700 1988 2FF9.tmp 91 PID 1988 wrote to memory of 3700 1988 2FF9.tmp 91 PID 1988 wrote to memory of 3700 1988 2FF9.tmp 91 PID 3700 wrote to memory of 1528 3700 3057.tmp 92 PID 3700 wrote to memory of 1528 3700 3057.tmp 92 PID 3700 wrote to memory of 1528 3700 3057.tmp 92 PID 1528 wrote to memory of 1440 1528 30A5.tmp 93 PID 1528 wrote to memory of 1440 1528 30A5.tmp 93 PID 1528 wrote to memory of 1440 1528 30A5.tmp 93 PID 1440 wrote to memory of 2044 1440 30F3.tmp 94 PID 1440 wrote to memory of 2044 1440 30F3.tmp 94 PID 1440 wrote to memory of 2044 1440 30F3.tmp 94 PID 2044 wrote to memory of 4016 2044 3170.tmp 95 PID 2044 wrote to memory of 4016 2044 3170.tmp 95 PID 2044 wrote to memory of 4016 2044 3170.tmp 95 PID 4016 wrote to memory of 3308 4016 31BE.tmp 96 PID 4016 wrote to memory of 3308 4016 31BE.tmp 96 PID 4016 wrote to memory of 3308 4016 31BE.tmp 96 PID 3308 wrote to memory of 2128 3308 323B.tmp 97 PID 3308 wrote to memory of 2128 3308 323B.tmp 97 PID 3308 wrote to memory of 2128 3308 323B.tmp 97 PID 2128 wrote to memory of 3512 2128 3289.tmp 98 PID 2128 wrote to memory of 3512 2128 3289.tmp 98 PID 2128 wrote to memory of 3512 2128 3289.tmp 98 PID 3512 wrote to memory of 1160 3512 32D7.tmp 99 PID 3512 wrote to memory of 1160 3512 32D7.tmp 99 PID 3512 wrote to memory of 1160 3512 32D7.tmp 99 PID 1160 wrote to memory of 1636 1160 3326.tmp 100 PID 1160 wrote to memory of 1636 1160 3326.tmp 100 PID 1160 wrote to memory of 1636 1160 3326.tmp 100 PID 1636 wrote to memory of 2700 1636 3383.tmp 101 PID 1636 wrote to memory of 2700 1636 3383.tmp 101 PID 1636 wrote to memory of 2700 1636 3383.tmp 101 PID 2700 wrote to memory of 3580 2700 33F1.tmp 102 PID 2700 wrote to memory of 3580 2700 33F1.tmp 102 PID 2700 wrote to memory of 3580 2700 33F1.tmp 102 PID 3580 wrote to memory of 3808 3580 343F.tmp 103 PID 3580 wrote to memory of 3808 3580 343F.tmp 103 PID 3580 wrote to memory of 3808 3580 343F.tmp 103 PID 3808 wrote to memory of 1520 3808 34AC.tmp 104 PID 3808 wrote to memory of 1520 3808 34AC.tmp 104 PID 3808 wrote to memory of 1520 3808 34AC.tmp 104 PID 1520 wrote to memory of 3916 1520 34FA.tmp 105 PID 1520 wrote to memory of 3916 1520 34FA.tmp 105 PID 1520 wrote to memory of 3916 1520 34FA.tmp 105 PID 3916 wrote to memory of 2624 3916 3568.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_392da5afb00939a6f56c92247a6b9fb8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\2E53.tmp"C:\Users\Admin\AppData\Local\Temp\2E53.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3057.tmp"C:\Users\Admin\AppData\Local\Temp\3057.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\30F3.tmp"C:\Users\Admin\AppData\Local\Temp\30F3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\323B.tmp"C:\Users\Admin\AppData\Local\Temp\323B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"23⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"24⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"25⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"26⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"27⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"28⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"29⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"30⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3885.tmp"C:\Users\Admin\AppData\Local\Temp\3885.tmp"31⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"32⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"33⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"34⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"35⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"36⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"37⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"38⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"39⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"40⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"41⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"42⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"43⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"44⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"45⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"46⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"47⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"48⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"49⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"50⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"51⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"52⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"53⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"54⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"55⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"56⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"57⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"58⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"59⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"60⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"61⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"62⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"63⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"64⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"65⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"66⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"67⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"68⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"69⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"70⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"71⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"72⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"73⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"74⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"75⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"76⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"77⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"79⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"80⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"81⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"83⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"84⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"85⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"86⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"87⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"88⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"89⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"91⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"92⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"93⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"94⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"95⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"96⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"97⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"99⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"100⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"101⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"102⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"103⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"104⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"105⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"106⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"107⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"108⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"109⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"110⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"111⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"112⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"113⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"114⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"115⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"116⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"117⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"118⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"119⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"120⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"121⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-