Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe
-
Size
529KB
-
MD5
4de88c6c9c5a6490cce389d15cd572d4
-
SHA1
6b8e6e49692199dab7c1155775198abb9949afbe
-
SHA256
7d678fcc14a55edab1607c923eab93f3720ccf0e3fbddcb6adcc98ede103cf24
-
SHA512
55bcf4328324438ac2173b6b1acd365c4d8b12bd19a025fad823ace146687b9e89e42ef4bcde7f0998cc48ff82e2d8d72fab6c456da7150d8b99c763f3973f9c
-
SSDEEP
12288:NU5rCOTeijn2pRaIa/sgp2NACQBx11VTZwlH4Hp:NUQOJjngDa0gpIQ1TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3980 3122.tmp 2948 31BE.tmp 4868 321C.tmp 1624 32A9.tmp 2212 3306.tmp 1452 3354.tmp 4292 33B2.tmp 2804 3420.tmp 2008 348D.tmp 3572 34EB.tmp 3764 3548.tmp 1520 35A6.tmp 4272 35F4.tmp 4436 3652.tmp 1504 36A0.tmp 2656 36EE.tmp 3672 373C.tmp 408 378B.tmp 3468 37E8.tmp 2960 3836.tmp 3508 38A4.tmp 3356 38F2.tmp 1692 3940.tmp 3248 398E.tmp 4556 39EC.tmp 1440 3A3A.tmp 3280 3A88.tmp 3864 3AD6.tmp 3472 3B24.tmp 1920 3B73.tmp 2488 3BE0.tmp 4744 3C3E.tmp 2668 3C8C.tmp 2864 3CDA.tmp 840 3D28.tmp 2856 3D67.tmp 3776 3DB5.tmp 4008 3E03.tmp 548 3E51.tmp 1640 3E9F.tmp 1728 3EED.tmp 4848 3F3B.tmp 4016 3F99.tmp 3572 3FE7.tmp 3816 4055.tmp 1196 40C2.tmp 2848 412F.tmp 5104 417D.tmp 2952 41CC.tmp 4360 421A.tmp 3048 4268.tmp 4448 42B6.tmp 2128 4323.tmp 636 43B0.tmp 4804 440E.tmp 1404 445C.tmp 888 44BA.tmp 5076 4508.tmp 4816 4565.tmp 1176 45B4.tmp 1860 4611.tmp 5108 465F.tmp 2572 46BD.tmp 4204 470B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 3980 2044 2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe 83 PID 2044 wrote to memory of 3980 2044 2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe 83 PID 2044 wrote to memory of 3980 2044 2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe 83 PID 3980 wrote to memory of 2948 3980 3122.tmp 84 PID 3980 wrote to memory of 2948 3980 3122.tmp 84 PID 3980 wrote to memory of 2948 3980 3122.tmp 84 PID 2948 wrote to memory of 4868 2948 31BE.tmp 85 PID 2948 wrote to memory of 4868 2948 31BE.tmp 85 PID 2948 wrote to memory of 4868 2948 31BE.tmp 85 PID 4868 wrote to memory of 1624 4868 321C.tmp 87 PID 4868 wrote to memory of 1624 4868 321C.tmp 87 PID 4868 wrote to memory of 1624 4868 321C.tmp 87 PID 1624 wrote to memory of 2212 1624 32A9.tmp 89 PID 1624 wrote to memory of 2212 1624 32A9.tmp 89 PID 1624 wrote to memory of 2212 1624 32A9.tmp 89 PID 2212 wrote to memory of 1452 2212 3306.tmp 90 PID 2212 wrote to memory of 1452 2212 3306.tmp 90 PID 2212 wrote to memory of 1452 2212 3306.tmp 90 PID 1452 wrote to memory of 4292 1452 3354.tmp 92 PID 1452 wrote to memory of 4292 1452 3354.tmp 92 PID 1452 wrote to memory of 4292 1452 3354.tmp 92 PID 4292 wrote to memory of 2804 4292 33B2.tmp 93 PID 4292 wrote to memory of 2804 4292 33B2.tmp 93 PID 4292 wrote to memory of 2804 4292 33B2.tmp 93 PID 2804 wrote to memory of 2008 2804 3420.tmp 94 PID 2804 wrote to memory of 2008 2804 3420.tmp 94 PID 2804 wrote to memory of 2008 2804 3420.tmp 94 PID 2008 wrote to memory of 3572 2008 348D.tmp 95 PID 2008 wrote to memory of 3572 2008 348D.tmp 95 PID 2008 wrote to memory of 3572 2008 348D.tmp 95 PID 3572 wrote to memory of 3764 3572 34EB.tmp 96 PID 3572 wrote to memory of 3764 3572 34EB.tmp 96 PID 3572 wrote to memory of 3764 3572 34EB.tmp 96 PID 3764 wrote to memory of 1520 3764 3548.tmp 97 PID 3764 wrote to memory of 1520 3764 3548.tmp 97 PID 3764 wrote to memory of 1520 3764 3548.tmp 97 PID 1520 wrote to memory of 4272 1520 35A6.tmp 98 PID 1520 wrote to memory of 4272 1520 35A6.tmp 98 PID 1520 wrote to memory of 4272 1520 35A6.tmp 98 PID 4272 wrote to memory of 4436 4272 35F4.tmp 99 PID 4272 wrote to memory of 4436 4272 35F4.tmp 99 PID 4272 wrote to memory of 4436 4272 35F4.tmp 99 PID 4436 wrote to memory of 1504 4436 3652.tmp 100 PID 4436 wrote to memory of 1504 4436 3652.tmp 100 PID 4436 wrote to memory of 1504 4436 3652.tmp 100 PID 1504 wrote to memory of 2656 1504 36A0.tmp 101 PID 1504 wrote to memory of 2656 1504 36A0.tmp 101 PID 1504 wrote to memory of 2656 1504 36A0.tmp 101 PID 2656 wrote to memory of 3672 2656 36EE.tmp 102 PID 2656 wrote to memory of 3672 2656 36EE.tmp 102 PID 2656 wrote to memory of 3672 2656 36EE.tmp 102 PID 3672 wrote to memory of 408 3672 373C.tmp 103 PID 3672 wrote to memory of 408 3672 373C.tmp 103 PID 3672 wrote to memory of 408 3672 373C.tmp 103 PID 408 wrote to memory of 3468 408 378B.tmp 104 PID 408 wrote to memory of 3468 408 378B.tmp 104 PID 408 wrote to memory of 3468 408 378B.tmp 104 PID 3468 wrote to memory of 2960 3468 37E8.tmp 105 PID 3468 wrote to memory of 2960 3468 37E8.tmp 105 PID 3468 wrote to memory of 2960 3468 37E8.tmp 105 PID 2960 wrote to memory of 3508 2960 3836.tmp 106 PID 2960 wrote to memory of 3508 2960 3836.tmp 106 PID 2960 wrote to memory of 3508 2960 3836.tmp 106 PID 3508 wrote to memory of 3356 3508 38A4.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_4de88c6c9c5a6490cce389d15cd572d4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\34EB.tmp"C:\Users\Admin\AppData\Local\Temp\34EB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"23⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"24⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"25⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"26⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"27⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"28⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"29⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"30⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"31⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"32⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"33⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"34⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"35⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"36⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"37⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"38⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"39⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"40⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"41⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"42⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"43⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"44⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"45⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"46⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"47⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"48⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"49⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"50⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"51⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"52⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"53⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"54⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"55⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"56⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"57⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"58⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"59⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"60⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"61⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"62⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"63⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"64⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"65⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"66⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"67⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"68⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"69⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"70⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"71⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"72⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"73⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"74⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"75⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"78⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"79⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"80⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"81⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"82⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"83⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"84⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"85⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"86⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"87⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"88⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"89⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"90⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"91⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"92⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"93⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"94⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"95⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"96⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"97⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"98⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"99⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"100⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"101⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"102⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"103⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"104⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"105⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"107⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"108⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"109⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"110⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"111⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"112⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"113⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"114⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"115⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"116⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"117⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"118⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"119⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"120⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"121⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"122⤵PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-