Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
-
Size
530KB
-
MD5
b24898215dab5cf7e0a756a3345cef74
-
SHA1
fb38bf65943c779384b1781692adcfdf21eca66e
-
SHA256
50c25b9bf26ca85ae0c9e21b733322eb2965a4e6508b070fa3532b77b1f1ce4e
-
SHA512
05537431373c995fbb0c2facb6aa1b9ce66bd4835fa95e47f5681a22ca217262f8a9e736c745932322ddf83a828be07f290dca47c941b52f75325bbf4647dcfc
-
SSDEEP
12288:AU5rCOTeio8uhymX8LnUOlpX48lfKJipOdDokNZulFVg0M1:AUQOJo8MymX8jLX48YopmDZNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3108 33C2.tmp 2964 346E.tmp 3928 34CB.tmp 1032 3529.tmp 1892 35A6.tmp 4560 3623.tmp 3424 36B0.tmp 2144 371D.tmp 3880 376B.tmp 1008 37C9.tmp 4924 3827.tmp 3188 3894.tmp 2872 3902.tmp 4684 396F.tmp 3140 39EC.tmp 4928 3A4A.tmp 4808 3AB7.tmp 2704 3B24.tmp 3368 3B73.tmp 3964 3BFF.tmp 1268 3C7C.tmp 388 3CDA.tmp 4224 3D47.tmp 2344 3DB5.tmp 2608 3E12.tmp 5056 3E8F.tmp 3876 3EDE.tmp 2416 3F2C.tmp 1640 3F7A.tmp 4888 3FF7.tmp 3068 4093.tmp 2460 4110.tmp 4092 415E.tmp 4988 41AC.tmp 4776 420A.tmp 4188 4258.tmp 4316 42A6.tmp 4288 4304.tmp 3616 4362.tmp 3992 43B0.tmp 2592 440E.tmp 2912 444C.tmp 1424 449A.tmp 4460 44E8.tmp 1728 4537.tmp 4608 4594.tmp 64 45E2.tmp 1496 4640.tmp 3284 468E.tmp 4344 46EC.tmp 2720 473A.tmp 3548 4788.tmp 3432 47D6.tmp 4204 4825.tmp 2908 4873.tmp 3928 48C1.tmp 944 490F.tmp 4576 495D.tmp 912 49AB.tmp 4844 4A09.tmp 5044 4A57.tmp 4604 4AA5.tmp 5008 4AF3.tmp 2728 4B41.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3108 4836 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 84 PID 4836 wrote to memory of 3108 4836 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 84 PID 4836 wrote to memory of 3108 4836 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 84 PID 3108 wrote to memory of 2964 3108 33C2.tmp 86 PID 3108 wrote to memory of 2964 3108 33C2.tmp 86 PID 3108 wrote to memory of 2964 3108 33C2.tmp 86 PID 2964 wrote to memory of 3928 2964 346E.tmp 87 PID 2964 wrote to memory of 3928 2964 346E.tmp 87 PID 2964 wrote to memory of 3928 2964 346E.tmp 87 PID 3928 wrote to memory of 1032 3928 34CB.tmp 89 PID 3928 wrote to memory of 1032 3928 34CB.tmp 89 PID 3928 wrote to memory of 1032 3928 34CB.tmp 89 PID 1032 wrote to memory of 1892 1032 3529.tmp 90 PID 1032 wrote to memory of 1892 1032 3529.tmp 90 PID 1032 wrote to memory of 1892 1032 3529.tmp 90 PID 1892 wrote to memory of 4560 1892 35A6.tmp 92 PID 1892 wrote to memory of 4560 1892 35A6.tmp 92 PID 1892 wrote to memory of 4560 1892 35A6.tmp 92 PID 4560 wrote to memory of 3424 4560 3623.tmp 93 PID 4560 wrote to memory of 3424 4560 3623.tmp 93 PID 4560 wrote to memory of 3424 4560 3623.tmp 93 PID 3424 wrote to memory of 2144 3424 36B0.tmp 94 PID 3424 wrote to memory of 2144 3424 36B0.tmp 94 PID 3424 wrote to memory of 2144 3424 36B0.tmp 94 PID 2144 wrote to memory of 3880 2144 371D.tmp 95 PID 2144 wrote to memory of 3880 2144 371D.tmp 95 PID 2144 wrote to memory of 3880 2144 371D.tmp 95 PID 3880 wrote to memory of 1008 3880 376B.tmp 96 PID 3880 wrote to memory of 1008 3880 376B.tmp 96 PID 3880 wrote to memory of 1008 3880 376B.tmp 96 PID 1008 wrote to memory of 4924 1008 37C9.tmp 97 PID 1008 wrote to memory of 4924 1008 37C9.tmp 97 PID 1008 wrote to memory of 4924 1008 37C9.tmp 97 PID 4924 wrote to memory of 3188 4924 3827.tmp 98 PID 4924 wrote to memory of 3188 4924 3827.tmp 98 PID 4924 wrote to memory of 3188 4924 3827.tmp 98 PID 3188 wrote to memory of 2872 3188 3894.tmp 99 PID 3188 wrote to memory of 2872 3188 3894.tmp 99 PID 3188 wrote to memory of 2872 3188 3894.tmp 99 PID 2872 wrote to memory of 4684 2872 3902.tmp 100 PID 2872 wrote to memory of 4684 2872 3902.tmp 100 PID 2872 wrote to memory of 4684 2872 3902.tmp 100 PID 4684 wrote to memory of 3140 4684 396F.tmp 101 PID 4684 wrote to memory of 3140 4684 396F.tmp 101 PID 4684 wrote to memory of 3140 4684 396F.tmp 101 PID 3140 wrote to memory of 4928 3140 39EC.tmp 102 PID 3140 wrote to memory of 4928 3140 39EC.tmp 102 PID 3140 wrote to memory of 4928 3140 39EC.tmp 102 PID 4928 wrote to memory of 4808 4928 3A4A.tmp 103 PID 4928 wrote to memory of 4808 4928 3A4A.tmp 103 PID 4928 wrote to memory of 4808 4928 3A4A.tmp 103 PID 4808 wrote to memory of 2704 4808 3AB7.tmp 104 PID 4808 wrote to memory of 2704 4808 3AB7.tmp 104 PID 4808 wrote to memory of 2704 4808 3AB7.tmp 104 PID 2704 wrote to memory of 3368 2704 3B24.tmp 105 PID 2704 wrote to memory of 3368 2704 3B24.tmp 105 PID 2704 wrote to memory of 3368 2704 3B24.tmp 105 PID 3368 wrote to memory of 3964 3368 3B73.tmp 106 PID 3368 wrote to memory of 3964 3368 3B73.tmp 106 PID 3368 wrote to memory of 3964 3368 3B73.tmp 106 PID 3964 wrote to memory of 1268 3964 3BFF.tmp 107 PID 3964 wrote to memory of 1268 3964 3BFF.tmp 107 PID 3964 wrote to memory of 1268 3964 3BFF.tmp 107 PID 1268 wrote to memory of 388 1268 3C7C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"23⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"24⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"25⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"26⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"27⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"28⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"29⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"30⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"31⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"32⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"33⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"34⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"35⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"36⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"37⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"38⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"39⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"40⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"41⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"42⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"43⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"44⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"45⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"46⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"47⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"48⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"49⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"50⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"51⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"52⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"53⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"54⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"55⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"56⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"57⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"58⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"59⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"60⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"61⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"62⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"63⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"64⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"65⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"66⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"67⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"68⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"69⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"70⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"71⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"72⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"73⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"74⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"75⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"76⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"77⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"78⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"79⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"80⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"81⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"82⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"83⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"84⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"85⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"86⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"87⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"88⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"89⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"90⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"91⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"92⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"93⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"94⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"95⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"96⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"97⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"98⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"99⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"100⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"101⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"102⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"103⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"104⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"105⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"106⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"107⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"108⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"109⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"110⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"111⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"112⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"113⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"114⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"115⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"116⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"117⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"118⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"119⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"120⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"121⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-