Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
-
Size
527KB
-
MD5
51a56aaae321b64ad21f40a1c6aa3070
-
SHA1
260bf6803a3eebc281babc2431848cdbeacb23d5
-
SHA256
c41933764f78a375417e019c0ea2acc63753c6654df76b348433bf3ca1b77260
-
SHA512
a9589f5691bf34395b587c89c5884cbdd282aeaf7a50cd6b2dde7841c4a62649bb33985adb6208034b2655b5bbb5b089147ac05000c93d28416fc2568d2fd65f
-
SSDEEP
12288:fU5rCOTeidd5AQs1Palr92FBAoKv36O8xVAeiqDZu:fUQOJdnA3YlRGAtvKO8xVAoDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3936 3597.tmp 3792 35F4.tmp 4628 3652.tmp 2664 36A0.tmp 1516 36EE.tmp 32 375C.tmp 876 37AA.tmp 4504 3808.tmp 1444 3846.tmp 1116 3894.tmp 4804 38E2.tmp 2328 3940.tmp 2432 398E.tmp 3040 39DC.tmp 3196 3A2A.tmp 4964 3AB7.tmp 1676 3B05.tmp 4492 3B53.tmp 804 3BA1.tmp 4660 3BF0.tmp 4832 3C3E.tmp 1080 3C8C.tmp 2344 3CDA.tmp 400 3D28.tmp 4728 3D76.tmp 4408 3DD4.tmp 3872 3E22.tmp 2356 3E70.tmp 4296 3EBE.tmp 2204 3F2C.tmp 3888 3F89.tmp 720 3FE7.tmp 3232 4035.tmp 3244 4093.tmp 2968 40E1.tmp 1304 412F.tmp 3236 417D.tmp 3520 41CC.tmp 2856 421A.tmp 2252 4268.tmp 3624 42A6.tmp 5024 4323.tmp 4472 4362.tmp 2852 43B0.tmp 1240 43FE.tmp 3936 443D.tmp 1840 447B.tmp 3080 44C9.tmp 824 4508.tmp 3656 4546.tmp 3820 4594.tmp 852 45D3.tmp 2664 4611.tmp 752 465F.tmp 1516 469E.tmp 4504 46EC.tmp 4876 472B.tmp 388 4779.tmp 2668 47C7.tmp 5008 4815.tmp 2728 4863.tmp 2500 48B1.tmp 436 48FF.tmp 3040 495D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 3936 4300 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 81 PID 4300 wrote to memory of 3936 4300 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 81 PID 4300 wrote to memory of 3936 4300 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 81 PID 3936 wrote to memory of 3792 3936 3597.tmp 83 PID 3936 wrote to memory of 3792 3936 3597.tmp 83 PID 3936 wrote to memory of 3792 3936 3597.tmp 83 PID 3792 wrote to memory of 4628 3792 35F4.tmp 86 PID 3792 wrote to memory of 4628 3792 35F4.tmp 86 PID 3792 wrote to memory of 4628 3792 35F4.tmp 86 PID 4628 wrote to memory of 2664 4628 3652.tmp 136 PID 4628 wrote to memory of 2664 4628 3652.tmp 136 PID 4628 wrote to memory of 2664 4628 3652.tmp 136 PID 2664 wrote to memory of 1516 2664 36A0.tmp 138 PID 2664 wrote to memory of 1516 2664 36A0.tmp 138 PID 2664 wrote to memory of 1516 2664 36A0.tmp 138 PID 1516 wrote to memory of 32 1516 36EE.tmp 89 PID 1516 wrote to memory of 32 1516 36EE.tmp 89 PID 1516 wrote to memory of 32 1516 36EE.tmp 89 PID 32 wrote to memory of 876 32 375C.tmp 90 PID 32 wrote to memory of 876 32 375C.tmp 90 PID 32 wrote to memory of 876 32 375C.tmp 90 PID 876 wrote to memory of 4504 876 37AA.tmp 139 PID 876 wrote to memory of 4504 876 37AA.tmp 139 PID 876 wrote to memory of 4504 876 37AA.tmp 139 PID 4504 wrote to memory of 1444 4504 3808.tmp 92 PID 4504 wrote to memory of 1444 4504 3808.tmp 92 PID 4504 wrote to memory of 1444 4504 3808.tmp 92 PID 1444 wrote to memory of 1116 1444 3846.tmp 93 PID 1444 wrote to memory of 1116 1444 3846.tmp 93 PID 1444 wrote to memory of 1116 1444 3846.tmp 93 PID 1116 wrote to memory of 4804 1116 3894.tmp 94 PID 1116 wrote to memory of 4804 1116 3894.tmp 94 PID 1116 wrote to memory of 4804 1116 3894.tmp 94 PID 4804 wrote to memory of 2328 4804 38E2.tmp 95 PID 4804 wrote to memory of 2328 4804 38E2.tmp 95 PID 4804 wrote to memory of 2328 4804 38E2.tmp 95 PID 2328 wrote to memory of 2432 2328 3940.tmp 96 PID 2328 wrote to memory of 2432 2328 3940.tmp 96 PID 2328 wrote to memory of 2432 2328 3940.tmp 96 PID 2432 wrote to memory of 3040 2432 398E.tmp 147 PID 2432 wrote to memory of 3040 2432 398E.tmp 147 PID 2432 wrote to memory of 3040 2432 398E.tmp 147 PID 3040 wrote to memory of 3196 3040 39DC.tmp 149 PID 3040 wrote to memory of 3196 3040 39DC.tmp 149 PID 3040 wrote to memory of 3196 3040 39DC.tmp 149 PID 3196 wrote to memory of 4964 3196 3A2A.tmp 99 PID 3196 wrote to memory of 4964 3196 3A2A.tmp 99 PID 3196 wrote to memory of 4964 3196 3A2A.tmp 99 PID 4964 wrote to memory of 1676 4964 3AB7.tmp 100 PID 4964 wrote to memory of 1676 4964 3AB7.tmp 100 PID 4964 wrote to memory of 1676 4964 3AB7.tmp 100 PID 1676 wrote to memory of 4492 1676 3B05.tmp 101 PID 1676 wrote to memory of 4492 1676 3B05.tmp 101 PID 1676 wrote to memory of 4492 1676 3B05.tmp 101 PID 4492 wrote to memory of 804 4492 3B53.tmp 102 PID 4492 wrote to memory of 804 4492 3B53.tmp 102 PID 4492 wrote to memory of 804 4492 3B53.tmp 102 PID 804 wrote to memory of 4660 804 3BA1.tmp 103 PID 804 wrote to memory of 4660 804 3BA1.tmp 103 PID 804 wrote to memory of 4660 804 3BA1.tmp 103 PID 4660 wrote to memory of 4832 4660 3BF0.tmp 104 PID 4660 wrote to memory of 4832 4660 3BF0.tmp 104 PID 4660 wrote to memory of 4832 4660 3BF0.tmp 104 PID 4832 wrote to memory of 1080 4832 3C3E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"23⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"24⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"25⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"26⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"27⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"28⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"29⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"30⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"31⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"32⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"33⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"34⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"35⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"36⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"37⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"38⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"39⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"40⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"41⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"42⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"43⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"44⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"45⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"46⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"47⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"48⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"49⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"50⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"51⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"52⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"53⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"54⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"55⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"56⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"57⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"58⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"59⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"60⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"61⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"62⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"63⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"65⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"66⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"67⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"68⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"70⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"71⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"72⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"73⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"74⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"75⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"76⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"77⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"78⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"79⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"80⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"82⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"83⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"84⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"86⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"87⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"88⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"89⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"90⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"91⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"92⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"93⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"94⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"95⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"96⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"97⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"98⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"99⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"101⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"102⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"103⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"104⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"105⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"106⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"107⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"108⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"109⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"110⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"111⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"112⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"113⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"114⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"115⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"116⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"117⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"118⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"119⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"120⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"121⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"122⤵PID:2400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-