Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 22:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe
-
Size
486KB
-
MD5
b70261f09c46c01ffee79d1cf7c5dfa3
-
SHA1
70cf427c9b5be999734798241a0cd8385dbccd8f
-
SHA256
2c25da98eee73f898a32b0cae974fc69210634341b3f85b266fb0c88ca7017b9
-
SHA512
e910b37205f624be144bbc75d99da722e8006aca27ec8a5904a32d022f28fc56dbd3143cb6c1ee43754de36b98a83457a37f6cfe08c7d183d6626c729685c758
-
SSDEEP
12288:/U5rCOTeiDd7uP5ANvdltP65UnBg6tPZNZ:/UQOJDd7Y8vPBOwg6hZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 844 2839.tmp 4596 2887.tmp 4272 28D5.tmp 916 2933.tmp 4688 2990.tmp 5044 29DF.tmp 3176 2A3C.tmp 456 2A8A.tmp 4328 2AE8.tmp 3368 2B46.tmp 4500 2B94.tmp 4484 2BE2.tmp 3852 2C30.tmp 3188 2E15.tmp 2516 2E63.tmp 2040 2EC1.tmp 5084 2F0F.tmp 1668 2F5D.tmp 4728 2FAB.tmp 220 3009.tmp 624 3057.tmp 2532 30A5.tmp 3376 30F3.tmp 5028 3151.tmp 4464 319F.tmp 724 31FD.tmp 3436 324B.tmp 4392 3299.tmp 2300 32E7.tmp 1248 3335.tmp 2260 33A3.tmp 692 33F1.tmp 4380 345E.tmp 4852 34AC.tmp 4528 34FA.tmp 752 3548.tmp 4368 3597.tmp 3504 35E5.tmp 1424 3633.tmp 516 3681.tmp 4420 36EE.tmp 4596 373C.tmp 2716 378B.tmp 4264 37D9.tmp 2340 3827.tmp 3232 3875.tmp 916 38C3.tmp 4120 3911.tmp 456 395F.tmp 2156 39AD.tmp 4576 39FC.tmp 3644 3A4A.tmp 2452 3A98.tmp 3960 3AE6.tmp 3188 3B34.tmp 2516 3B82.tmp 4928 3BD0.tmp 4940 3C2E.tmp 512 3C7C.tmp 212 3CDA.tmp 4728 3D38.tmp 232 3D95.tmp 624 3E22.tmp 2532 3E9F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 844 1744 2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe 83 PID 1744 wrote to memory of 844 1744 2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe 83 PID 1744 wrote to memory of 844 1744 2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe 83 PID 844 wrote to memory of 4596 844 2839.tmp 131 PID 844 wrote to memory of 4596 844 2839.tmp 131 PID 844 wrote to memory of 4596 844 2839.tmp 131 PID 4596 wrote to memory of 4272 4596 2887.tmp 88 PID 4596 wrote to memory of 4272 4596 2887.tmp 88 PID 4596 wrote to memory of 4272 4596 2887.tmp 88 PID 4272 wrote to memory of 916 4272 28D5.tmp 136 PID 4272 wrote to memory of 916 4272 28D5.tmp 136 PID 4272 wrote to memory of 916 4272 28D5.tmp 136 PID 916 wrote to memory of 4688 916 2933.tmp 90 PID 916 wrote to memory of 4688 916 2933.tmp 90 PID 916 wrote to memory of 4688 916 2933.tmp 90 PID 4688 wrote to memory of 5044 4688 2990.tmp 91 PID 4688 wrote to memory of 5044 4688 2990.tmp 91 PID 4688 wrote to memory of 5044 4688 2990.tmp 91 PID 5044 wrote to memory of 3176 5044 29DF.tmp 92 PID 5044 wrote to memory of 3176 5044 29DF.tmp 92 PID 5044 wrote to memory of 3176 5044 29DF.tmp 92 PID 3176 wrote to memory of 456 3176 2A3C.tmp 139 PID 3176 wrote to memory of 456 3176 2A3C.tmp 139 PID 3176 wrote to memory of 456 3176 2A3C.tmp 139 PID 456 wrote to memory of 4328 456 2A8A.tmp 94 PID 456 wrote to memory of 4328 456 2A8A.tmp 94 PID 456 wrote to memory of 4328 456 2A8A.tmp 94 PID 4328 wrote to memory of 3368 4328 2AE8.tmp 95 PID 4328 wrote to memory of 3368 4328 2AE8.tmp 95 PID 4328 wrote to memory of 3368 4328 2AE8.tmp 95 PID 3368 wrote to memory of 4500 3368 2B46.tmp 96 PID 3368 wrote to memory of 4500 3368 2B46.tmp 96 PID 3368 wrote to memory of 4500 3368 2B46.tmp 96 PID 4500 wrote to memory of 4484 4500 2B94.tmp 97 PID 4500 wrote to memory of 4484 4500 2B94.tmp 97 PID 4500 wrote to memory of 4484 4500 2B94.tmp 97 PID 4484 wrote to memory of 3852 4484 2BE2.tmp 98 PID 4484 wrote to memory of 3852 4484 2BE2.tmp 98 PID 4484 wrote to memory of 3852 4484 2BE2.tmp 98 PID 3852 wrote to memory of 3188 3852 2C30.tmp 146 PID 3852 wrote to memory of 3188 3852 2C30.tmp 146 PID 3852 wrote to memory of 3188 3852 2C30.tmp 146 PID 3188 wrote to memory of 2516 3188 2E15.tmp 147 PID 3188 wrote to memory of 2516 3188 2E15.tmp 147 PID 3188 wrote to memory of 2516 3188 2E15.tmp 147 PID 2516 wrote to memory of 2040 2516 2E63.tmp 101 PID 2516 wrote to memory of 2040 2516 2E63.tmp 101 PID 2516 wrote to memory of 2040 2516 2E63.tmp 101 PID 2040 wrote to memory of 5084 2040 2EC1.tmp 102 PID 2040 wrote to memory of 5084 2040 2EC1.tmp 102 PID 2040 wrote to memory of 5084 2040 2EC1.tmp 102 PID 5084 wrote to memory of 1668 5084 2F0F.tmp 103 PID 5084 wrote to memory of 1668 5084 2F0F.tmp 103 PID 5084 wrote to memory of 1668 5084 2F0F.tmp 103 PID 1668 wrote to memory of 4728 1668 2F5D.tmp 152 PID 1668 wrote to memory of 4728 1668 2F5D.tmp 152 PID 1668 wrote to memory of 4728 1668 2F5D.tmp 152 PID 4728 wrote to memory of 220 4728 2FAB.tmp 105 PID 4728 wrote to memory of 220 4728 2FAB.tmp 105 PID 4728 wrote to memory of 220 4728 2FAB.tmp 105 PID 220 wrote to memory of 624 220 3009.tmp 154 PID 220 wrote to memory of 624 220 3009.tmp 154 PID 220 wrote to memory of 624 220 3009.tmp 154 PID 624 wrote to memory of 2532 624 3057.tmp 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_b70261f09c46c01ffee79d1cf7c5dfa3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2933.tmp"C:\Users\Admin\AppData\Local\Temp\2933.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\29DF.tmp"C:\Users\Admin\AppData\Local\Temp\29DF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\2AE8.tmp"C:\Users\Admin\AppData\Local\Temp\2AE8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\2B46.tmp"C:\Users\Admin\AppData\Local\Temp\2B46.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2B94.tmp"C:\Users\Admin\AppData\Local\Temp\2B94.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2C30.tmp"C:\Users\Admin\AppData\Local\Temp\2C30.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\2E15.tmp"C:\Users\Admin\AppData\Local\Temp\2E15.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2E63.tmp"C:\Users\Admin\AppData\Local\Temp\2E63.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3009.tmp"C:\Users\Admin\AppData\Local\Temp\3009.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\3057.tmp"C:\Users\Admin\AppData\Local\Temp\3057.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"23⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\30F3.tmp"C:\Users\Admin\AppData\Local\Temp\30F3.tmp"24⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"25⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"26⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\31FD.tmp"C:\Users\Admin\AppData\Local\Temp\31FD.tmp"27⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"28⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"29⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"30⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"31⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"32⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"33⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"34⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"35⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"36⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"37⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"38⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"39⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"40⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"41⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"42⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"43⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"44⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"45⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"46⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"47⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"48⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"49⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"50⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"51⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"52⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"53⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"54⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"55⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"56⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"57⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"58⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"59⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"60⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"61⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"62⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"63⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"64⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"65⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"66⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"67⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"68⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"69⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"70⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"71⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"72⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"73⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"74⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"75⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"76⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"77⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"78⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"79⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"80⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"81⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"82⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"83⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"84⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"85⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"86⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"87⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"88⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"89⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"90⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"91⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"92⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"93⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"94⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"95⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"96⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"97⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"98⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"99⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"100⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"101⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"102⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"103⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"104⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"105⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"106⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"107⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"108⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"109⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"110⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"111⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"112⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"113⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"114⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"115⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"116⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"117⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"118⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"119⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"120⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"121⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-