Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
-
Size
765KB
-
MD5
87bdff3a138a49b832df1654d09f9a07
-
SHA1
0946eb283c02326b7d6ec04b67b1d93ea3470ede
-
SHA256
e1913772685f4d08d7edd4c3be3a9a7401a60099b14d1b97bd89c30810028cef
-
SHA512
290eda03bf8292a7b2d2f8e9c832e34a39475fb64fed6991215f8a7a41f44cd22c90add2767ea913aa495ed2a2c5ac21d519c3364530269188715afeb4c00375
-
SSDEEP
12288:ZU5rCOTeiDvXQ/uZK6Ck6Ohdpx3ZF5rn5rLOa54U5w5A:ZUQOJDvg2ZK0V73vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3616 346E.tmp 1452 34CB.tmp 64 3529.tmp 3732 3577.tmp 2556 35C5.tmp 8 3614.tmp 2452 3662.tmp 2128 36CF.tmp 4340 371D.tmp 1688 376B.tmp 3104 37B9.tmp 2332 3808.tmp 4748 3856.tmp 3980 38B3.tmp 5116 3902.tmp 4336 3950.tmp 1036 399E.tmp 1680 39EC.tmp 2712 3A3A.tmp 4852 3AA7.tmp 4476 3AF6.tmp 4688 3B44.tmp 3380 3BA1.tmp 4596 3BF0.tmp 1588 3C4D.tmp 2948 3C9B.tmp 3964 3CEA.tmp 436 3D67.tmp 3804 3DC4.tmp 3524 3E32.tmp 1944 3E8F.tmp 3956 3EED.tmp 4992 3F4B.tmp 4428 3FA9.tmp 3196 4006.tmp 3604 4055.tmp 3660 40A3.tmp 2952 40F1.tmp 4044 413F.tmp 4252 418D.tmp 2036 41DB.tmp 3952 4229.tmp 1684 4277.tmp 4404 42C6.tmp 4524 4323.tmp 3484 4371.tmp 3860 43C0.tmp 1096 440E.tmp 1656 445C.tmp 448 44AA.tmp 4936 44F8.tmp 1088 4546.tmp 4288 4594.tmp 3628 45E2.tmp 3480 4631.tmp 4952 466F.tmp 4464 46BD.tmp 4588 470B.tmp 4364 4759.tmp 2128 47A8.tmp 4188 47F6.tmp 4120 4844.tmp 3544 4892.tmp 4224 48E0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 3616 1884 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 82 PID 1884 wrote to memory of 3616 1884 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 82 PID 1884 wrote to memory of 3616 1884 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 82 PID 3616 wrote to memory of 1452 3616 346E.tmp 85 PID 3616 wrote to memory of 1452 3616 346E.tmp 85 PID 3616 wrote to memory of 1452 3616 346E.tmp 85 PID 1452 wrote to memory of 64 1452 34CB.tmp 87 PID 1452 wrote to memory of 64 1452 34CB.tmp 87 PID 1452 wrote to memory of 64 1452 34CB.tmp 87 PID 64 wrote to memory of 3732 64 3529.tmp 88 PID 64 wrote to memory of 3732 64 3529.tmp 88 PID 64 wrote to memory of 3732 64 3529.tmp 88 PID 3732 wrote to memory of 2556 3732 3577.tmp 89 PID 3732 wrote to memory of 2556 3732 3577.tmp 89 PID 3732 wrote to memory of 2556 3732 3577.tmp 89 PID 2556 wrote to memory of 8 2556 35C5.tmp 90 PID 2556 wrote to memory of 8 2556 35C5.tmp 90 PID 2556 wrote to memory of 8 2556 35C5.tmp 90 PID 8 wrote to memory of 2452 8 3614.tmp 91 PID 8 wrote to memory of 2452 8 3614.tmp 91 PID 8 wrote to memory of 2452 8 3614.tmp 91 PID 2452 wrote to memory of 2128 2452 3662.tmp 92 PID 2452 wrote to memory of 2128 2452 3662.tmp 92 PID 2452 wrote to memory of 2128 2452 3662.tmp 92 PID 2128 wrote to memory of 4340 2128 36CF.tmp 93 PID 2128 wrote to memory of 4340 2128 36CF.tmp 93 PID 2128 wrote to memory of 4340 2128 36CF.tmp 93 PID 4340 wrote to memory of 1688 4340 371D.tmp 94 PID 4340 wrote to memory of 1688 4340 371D.tmp 94 PID 4340 wrote to memory of 1688 4340 371D.tmp 94 PID 1688 wrote to memory of 3104 1688 376B.tmp 95 PID 1688 wrote to memory of 3104 1688 376B.tmp 95 PID 1688 wrote to memory of 3104 1688 376B.tmp 95 PID 3104 wrote to memory of 2332 3104 37B9.tmp 96 PID 3104 wrote to memory of 2332 3104 37B9.tmp 96 PID 3104 wrote to memory of 2332 3104 37B9.tmp 96 PID 2332 wrote to memory of 4748 2332 3808.tmp 150 PID 2332 wrote to memory of 4748 2332 3808.tmp 150 PID 2332 wrote to memory of 4748 2332 3808.tmp 150 PID 4748 wrote to memory of 3980 4748 3856.tmp 98 PID 4748 wrote to memory of 3980 4748 3856.tmp 98 PID 4748 wrote to memory of 3980 4748 3856.tmp 98 PID 3980 wrote to memory of 5116 3980 38B3.tmp 99 PID 3980 wrote to memory of 5116 3980 38B3.tmp 99 PID 3980 wrote to memory of 5116 3980 38B3.tmp 99 PID 5116 wrote to memory of 4336 5116 3902.tmp 100 PID 5116 wrote to memory of 4336 5116 3902.tmp 100 PID 5116 wrote to memory of 4336 5116 3902.tmp 100 PID 4336 wrote to memory of 1036 4336 3950.tmp 101 PID 4336 wrote to memory of 1036 4336 3950.tmp 101 PID 4336 wrote to memory of 1036 4336 3950.tmp 101 PID 1036 wrote to memory of 1680 1036 399E.tmp 102 PID 1036 wrote to memory of 1680 1036 399E.tmp 102 PID 1036 wrote to memory of 1680 1036 399E.tmp 102 PID 1680 wrote to memory of 2712 1680 39EC.tmp 103 PID 1680 wrote to memory of 2712 1680 39EC.tmp 103 PID 1680 wrote to memory of 2712 1680 39EC.tmp 103 PID 2712 wrote to memory of 4852 2712 3A3A.tmp 104 PID 2712 wrote to memory of 4852 2712 3A3A.tmp 104 PID 2712 wrote to memory of 4852 2712 3A3A.tmp 104 PID 4852 wrote to memory of 4476 4852 3AA7.tmp 105 PID 4852 wrote to memory of 4476 4852 3AA7.tmp 105 PID 4852 wrote to memory of 4476 4852 3AA7.tmp 105 PID 4476 wrote to memory of 4688 4476 3AF6.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"23⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"24⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"25⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"26⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"27⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"28⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"29⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"30⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"31⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"32⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"33⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"34⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"35⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"36⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"37⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"38⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"39⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"40⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"41⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"42⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"43⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"44⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"45⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"46⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"47⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"48⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"49⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"50⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"51⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"52⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"53⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"54⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"55⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"56⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"57⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"58⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"60⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"61⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"62⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"63⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"64⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"65⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"66⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"67⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"68⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"69⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"70⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"71⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"73⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"74⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"75⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"76⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"77⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"78⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"79⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"80⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"81⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"82⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"83⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"84⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"85⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"86⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"87⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"88⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"89⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"90⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"91⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"92⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"93⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"94⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"95⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"96⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"97⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"98⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"99⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"101⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"102⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"103⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"104⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"105⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"106⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"107⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"108⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"109⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"110⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"111⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"112⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"113⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"114⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"115⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"116⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"117⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"118⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"119⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"120⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"121⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"122⤵PID:4040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-