Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 08:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe
-
Size
520KB
-
MD5
a4f24c5fe38b0f93774047cb644f6460
-
SHA1
9d4da5ca70abd345ceb81f0521d1eb40cc82dbbf
-
SHA256
0738e91ce8997bf5bf6561de7356c96bf3434ab3d4ca3c4e0c36d0e48f0cb13c
-
SHA512
20ff43255d0a1d1184147eab479415e816ea953d340abba248686a7176e9f3bdbcbacdcbe50e199bdb5db35c667af4003df673fe3117494a467ad211a781ce41
-
SSDEEP
12288:roRXOQjmOy8455H/NFLafOFYZHXsBpgoNZ:rogQ9y8S5fjUsmHXiN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1876 FD5B.tmp 3708 FF6E.tmp 4340 97.tmp 3768 1B1.tmp 4764 2BA.tmp 5008 3A5.tmp 4812 470.tmp 3860 52B.tmp 2940 5D7.tmp 3468 683.tmp 620 77D.tmp 880 838.tmp 1212 913.tmp 4360 A3C.tmp 2284 B07.tmp 5112 BD2.tmp 1240 C4F.tmp 4904 D0B.tmp 4536 D97.tmp 2716 E05.tmp 4020 E91.tmp 544 F3D.tmp 4788 FE9.tmp 4500 1085.tmp 4032 1102.tmp 1544 11AE.tmp 1132 125A.tmp 3852 12E7.tmp 1564 1373.tmp 1100 1400.tmp 2612 149C.tmp 2780 1539.tmp 456 15B6.tmp 2884 1633.tmp 4136 16A0.tmp 4320 173C.tmp 4428 1817.tmp 4400 18E2.tmp 4512 196F.tmp 636 1A0B.tmp 4044 1B43.tmp 696 1BEF.tmp 4128 1C8C.tmp 4308 1DB4.tmp 3668 1E80.tmp 4248 1FC8.tmp 3976 2035.tmp 3228 20C2.tmp 3860 213F.tmp 404 21DB.tmp 5044 2287.tmp 4804 2333.tmp 620 23B0.tmp 2096 243C.tmp 2268 24C9.tmp 1004 2565.tmp 4360 25D3.tmp 2892 265F.tmp 3156 270B.tmp 1240 2798.tmp 2932 2824.tmp 3044 28B1.tmp 3056 295D.tmp 1124 29DA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 1876 4480 2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe 92 PID 4480 wrote to memory of 1876 4480 2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe 92 PID 4480 wrote to memory of 1876 4480 2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe 92 PID 1876 wrote to memory of 3708 1876 FD5B.tmp 93 PID 1876 wrote to memory of 3708 1876 FD5B.tmp 93 PID 1876 wrote to memory of 3708 1876 FD5B.tmp 93 PID 3708 wrote to memory of 4340 3708 FF6E.tmp 94 PID 3708 wrote to memory of 4340 3708 FF6E.tmp 94 PID 3708 wrote to memory of 4340 3708 FF6E.tmp 94 PID 4340 wrote to memory of 3768 4340 97.tmp 95 PID 4340 wrote to memory of 3768 4340 97.tmp 95 PID 4340 wrote to memory of 3768 4340 97.tmp 95 PID 3768 wrote to memory of 4764 3768 1B1.tmp 96 PID 3768 wrote to memory of 4764 3768 1B1.tmp 96 PID 3768 wrote to memory of 4764 3768 1B1.tmp 96 PID 4764 wrote to memory of 5008 4764 2BA.tmp 97 PID 4764 wrote to memory of 5008 4764 2BA.tmp 97 PID 4764 wrote to memory of 5008 4764 2BA.tmp 97 PID 5008 wrote to memory of 4812 5008 3A5.tmp 98 PID 5008 wrote to memory of 4812 5008 3A5.tmp 98 PID 5008 wrote to memory of 4812 5008 3A5.tmp 98 PID 4812 wrote to memory of 3860 4812 470.tmp 99 PID 4812 wrote to memory of 3860 4812 470.tmp 99 PID 4812 wrote to memory of 3860 4812 470.tmp 99 PID 3860 wrote to memory of 2940 3860 52B.tmp 100 PID 3860 wrote to memory of 2940 3860 52B.tmp 100 PID 3860 wrote to memory of 2940 3860 52B.tmp 100 PID 2940 wrote to memory of 3468 2940 5D7.tmp 101 PID 2940 wrote to memory of 3468 2940 5D7.tmp 101 PID 2940 wrote to memory of 3468 2940 5D7.tmp 101 PID 3468 wrote to memory of 620 3468 683.tmp 102 PID 3468 wrote to memory of 620 3468 683.tmp 102 PID 3468 wrote to memory of 620 3468 683.tmp 102 PID 620 wrote to memory of 880 620 77D.tmp 103 PID 620 wrote to memory of 880 620 77D.tmp 103 PID 620 wrote to memory of 880 620 77D.tmp 103 PID 880 wrote to memory of 1212 880 838.tmp 104 PID 880 wrote to memory of 1212 880 838.tmp 104 PID 880 wrote to memory of 1212 880 838.tmp 104 PID 1212 wrote to memory of 4360 1212 913.tmp 105 PID 1212 wrote to memory of 4360 1212 913.tmp 105 PID 1212 wrote to memory of 4360 1212 913.tmp 105 PID 4360 wrote to memory of 2284 4360 A3C.tmp 106 PID 4360 wrote to memory of 2284 4360 A3C.tmp 106 PID 4360 wrote to memory of 2284 4360 A3C.tmp 106 PID 2284 wrote to memory of 5112 2284 B07.tmp 107 PID 2284 wrote to memory of 5112 2284 B07.tmp 107 PID 2284 wrote to memory of 5112 2284 B07.tmp 107 PID 5112 wrote to memory of 1240 5112 BD2.tmp 108 PID 5112 wrote to memory of 1240 5112 BD2.tmp 108 PID 5112 wrote to memory of 1240 5112 BD2.tmp 108 PID 1240 wrote to memory of 4904 1240 C4F.tmp 109 PID 1240 wrote to memory of 4904 1240 C4F.tmp 109 PID 1240 wrote to memory of 4904 1240 C4F.tmp 109 PID 4904 wrote to memory of 4536 4904 D0B.tmp 110 PID 4904 wrote to memory of 4536 4904 D0B.tmp 110 PID 4904 wrote to memory of 4536 4904 D0B.tmp 110 PID 4536 wrote to memory of 2716 4536 D97.tmp 111 PID 4536 wrote to memory of 2716 4536 D97.tmp 111 PID 4536 wrote to memory of 2716 4536 D97.tmp 111 PID 2716 wrote to memory of 4020 2716 E05.tmp 112 PID 2716 wrote to memory of 4020 2716 E05.tmp 112 PID 2716 wrote to memory of 4020 2716 E05.tmp 112 PID 4020 wrote to memory of 544 4020 E91.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_a4f24c5fe38b0f93774047cb644f6460_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"23⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"24⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"25⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"26⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"27⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"28⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"29⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"30⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"31⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"32⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"33⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"34⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"35⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"36⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"37⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"38⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"39⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"40⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"41⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"42⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"43⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"44⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"45⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"46⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"47⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"48⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"49⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"50⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"51⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"52⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"53⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"54⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"55⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"56⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"57⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"58⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"59⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"60⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"61⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"62⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"63⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"64⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"65⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"66⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"67⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"68⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"69⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"70⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"71⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"72⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"74⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"75⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"76⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"77⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"79⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"80⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"81⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"82⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"83⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"84⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"85⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"86⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"87⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"88⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"89⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"90⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"91⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"92⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"93⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"94⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"95⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"96⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"97⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"98⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"99⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"100⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"101⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"103⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"104⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"105⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"106⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"107⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"108⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"109⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"110⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"111⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"112⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"113⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"114⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"115⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"116⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"117⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\4774.tmp"C:\Users\Admin\AppData\Local\Temp\4774.tmp"118⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"119⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"120⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"121⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"122⤵PID:4060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-