Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe
-
Size
541KB
-
MD5
b0e27d58f48a7bffcc3bb1e7aff6bff2
-
SHA1
51846fe9e66a5462990c793007956c11f83015ec
-
SHA256
188894c1e2f2ca4e27175be24a121cee4590b16485081a1339fa9320d97d394c
-
SHA512
a088df6369d1192bf7f8f38a2101bdb89ba7ed4ba43ac7b5ffd80f061e8375a4b2446775b6682e8cda2cbafc924bb205e26beafb905583e16baaf867943a09db
-
SSDEEP
12288:UU5rCOTeifFQ64uYhl7pOnoGtjHXFVFUs4aZrZa73ctO:UUQOJfu649ffGV3FndrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4392 25D7.tmp 1460 2654.tmp 3224 26B2.tmp 2788 272F.tmp 212 279C.tmp 2928 280A.tmp 3992 2887.tmp 1552 28D5.tmp 2196 2933.tmp 3428 29A0.tmp 1792 2A0D.tmp 4804 2A5C.tmp 2428 2AB9.tmp 5068 2B07.tmp 4628 2B84.tmp 1192 2BE2.tmp 428 2C5F.tmp 1900 2CCD.tmp 3496 2D2A.tmp 3748 2D98.tmp 2488 2DE6.tmp 1248 2E34.tmp 812 2E92.tmp 4288 2EE0.tmp 436 2F5D.tmp 3516 2FCA.tmp 404 3028.tmp 2740 3076.tmp 3116 30C4.tmp 316 3132.tmp 2440 3180.tmp 2904 31DD.tmp 3100 324B.tmp 2688 3299.tmp 3520 32E7.tmp 2592 3335.tmp 3648 3383.tmp 2080 33D1.tmp 3940 3420.tmp 4924 349D.tmp 4452 34FA.tmp 5060 3548.tmp 4544 3597.tmp 4540 35E5.tmp 3464 3642.tmp 1252 3691.tmp 4340 36DF.tmp 4244 372D.tmp 4280 37C9.tmp 5056 3817.tmp 3372 3865.tmp 4780 38B3.tmp 3440 3902.tmp 4860 3950.tmp 3068 39AD.tmp 4664 39FC.tmp 636 3A4A.tmp 3732 3A98.tmp 1708 3AE6.tmp 3556 3B34.tmp 3836 3B82.tmp 3992 3BD0.tmp 1552 3C1E.tmp 1732 3C6D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4392 3432 2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe 82 PID 3432 wrote to memory of 4392 3432 2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe 82 PID 3432 wrote to memory of 4392 3432 2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe 82 PID 4392 wrote to memory of 1460 4392 25D7.tmp 84 PID 4392 wrote to memory of 1460 4392 25D7.tmp 84 PID 4392 wrote to memory of 1460 4392 25D7.tmp 84 PID 1460 wrote to memory of 3224 1460 2654.tmp 85 PID 1460 wrote to memory of 3224 1460 2654.tmp 85 PID 1460 wrote to memory of 3224 1460 2654.tmp 85 PID 3224 wrote to memory of 2788 3224 26B2.tmp 87 PID 3224 wrote to memory of 2788 3224 26B2.tmp 87 PID 3224 wrote to memory of 2788 3224 26B2.tmp 87 PID 2788 wrote to memory of 212 2788 272F.tmp 88 PID 2788 wrote to memory of 212 2788 272F.tmp 88 PID 2788 wrote to memory of 212 2788 272F.tmp 88 PID 212 wrote to memory of 2928 212 279C.tmp 89 PID 212 wrote to memory of 2928 212 279C.tmp 89 PID 212 wrote to memory of 2928 212 279C.tmp 89 PID 2928 wrote to memory of 3992 2928 280A.tmp 90 PID 2928 wrote to memory of 3992 2928 280A.tmp 90 PID 2928 wrote to memory of 3992 2928 280A.tmp 90 PID 3992 wrote to memory of 1552 3992 2887.tmp 91 PID 3992 wrote to memory of 1552 3992 2887.tmp 91 PID 3992 wrote to memory of 1552 3992 2887.tmp 91 PID 1552 wrote to memory of 2196 1552 28D5.tmp 92 PID 1552 wrote to memory of 2196 1552 28D5.tmp 92 PID 1552 wrote to memory of 2196 1552 28D5.tmp 92 PID 2196 wrote to memory of 3428 2196 2933.tmp 93 PID 2196 wrote to memory of 3428 2196 2933.tmp 93 PID 2196 wrote to memory of 3428 2196 2933.tmp 93 PID 3428 wrote to memory of 1792 3428 29A0.tmp 94 PID 3428 wrote to memory of 1792 3428 29A0.tmp 94 PID 3428 wrote to memory of 1792 3428 29A0.tmp 94 PID 1792 wrote to memory of 4804 1792 2A0D.tmp 95 PID 1792 wrote to memory of 4804 1792 2A0D.tmp 95 PID 1792 wrote to memory of 4804 1792 2A0D.tmp 95 PID 4804 wrote to memory of 2428 4804 2A5C.tmp 96 PID 4804 wrote to memory of 2428 4804 2A5C.tmp 96 PID 4804 wrote to memory of 2428 4804 2A5C.tmp 96 PID 2428 wrote to memory of 5068 2428 2AB9.tmp 97 PID 2428 wrote to memory of 5068 2428 2AB9.tmp 97 PID 2428 wrote to memory of 5068 2428 2AB9.tmp 97 PID 5068 wrote to memory of 4628 5068 2B07.tmp 98 PID 5068 wrote to memory of 4628 5068 2B07.tmp 98 PID 5068 wrote to memory of 4628 5068 2B07.tmp 98 PID 4628 wrote to memory of 1192 4628 2B84.tmp 99 PID 4628 wrote to memory of 1192 4628 2B84.tmp 99 PID 4628 wrote to memory of 1192 4628 2B84.tmp 99 PID 1192 wrote to memory of 428 1192 2BE2.tmp 100 PID 1192 wrote to memory of 428 1192 2BE2.tmp 100 PID 1192 wrote to memory of 428 1192 2BE2.tmp 100 PID 428 wrote to memory of 1900 428 2C5F.tmp 101 PID 428 wrote to memory of 1900 428 2C5F.tmp 101 PID 428 wrote to memory of 1900 428 2C5F.tmp 101 PID 1900 wrote to memory of 3496 1900 2CCD.tmp 102 PID 1900 wrote to memory of 3496 1900 2CCD.tmp 102 PID 1900 wrote to memory of 3496 1900 2CCD.tmp 102 PID 3496 wrote to memory of 3748 3496 2D2A.tmp 103 PID 3496 wrote to memory of 3748 3496 2D2A.tmp 103 PID 3496 wrote to memory of 3748 3496 2D2A.tmp 103 PID 3748 wrote to memory of 2488 3748 2D98.tmp 104 PID 3748 wrote to memory of 2488 3748 2D98.tmp 104 PID 3748 wrote to memory of 2488 3748 2D98.tmp 104 PID 2488 wrote to memory of 1248 2488 2DE6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_b0e27d58f48a7bffcc3bb1e7aff6bff2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\25D7.tmp"C:\Users\Admin\AppData\Local\Temp\25D7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2654.tmp"C:\Users\Admin\AppData\Local\Temp\2654.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\26B2.tmp"C:\Users\Admin\AppData\Local\Temp\26B2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\272F.tmp"C:\Users\Admin\AppData\Local\Temp\272F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\279C.tmp"C:\Users\Admin\AppData\Local\Temp\279C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2933.tmp"C:\Users\Admin\AppData\Local\Temp\2933.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2A5C.tmp"C:\Users\Admin\AppData\Local\Temp\2A5C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2AB9.tmp"C:\Users\Admin\AppData\Local\Temp\2AB9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2B07.tmp"C:\Users\Admin\AppData\Local\Temp\2B07.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2B84.tmp"C:\Users\Admin\AppData\Local\Temp\2B84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\2CCD.tmp"C:\Users\Admin\AppData\Local\Temp\2CCD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"C:\Users\Admin\AppData\Local\Temp\2D2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\2D98.tmp"C:\Users\Admin\AppData\Local\Temp\2D98.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\2DE6.tmp"C:\Users\Admin\AppData\Local\Temp\2DE6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2E34.tmp"C:\Users\Admin\AppData\Local\Temp\2E34.tmp"23⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2E92.tmp"C:\Users\Admin\AppData\Local\Temp\2E92.tmp"24⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2EE0.tmp"C:\Users\Admin\AppData\Local\Temp\2EE0.tmp"25⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"26⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"27⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"28⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"29⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\30C4.tmp"C:\Users\Admin\AppData\Local\Temp\30C4.tmp"30⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"31⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"32⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"33⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"34⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"35⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"36⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"37⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"38⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"39⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"40⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"41⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"42⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"43⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"44⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"45⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"46⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"47⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"48⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"49⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"50⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"51⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"52⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"53⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"54⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"55⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"56⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"57⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"58⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"59⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"60⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"61⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"62⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"63⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"64⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"65⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"66⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"67⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"68⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"69⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"70⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"71⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"72⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"73⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"74⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"75⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"76⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"77⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"78⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"79⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"80⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"81⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"82⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"83⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"84⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"85⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"86⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"87⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"88⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"89⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"90⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"91⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"92⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"93⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"94⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"95⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"96⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"97⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"98⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"99⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"100⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"101⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"102⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"104⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"105⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"106⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"107⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"108⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"110⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"111⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"112⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"113⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"114⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"115⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"116⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"117⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"118⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"119⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"120⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"121⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-