Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 10:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe
-
Size
487KB
-
MD5
608895657b3bd9e47f64b6f33414a02a
-
SHA1
b15884fd4004a700b9d879093685bcfbb12f4d0c
-
SHA256
62dc212b83a63fa541f2b447ffb36818fa4e7bad0f8124e3ed4400519ab6b32a
-
SHA512
bc617f7e01654ccdda06fde0d5f0a6b085bb1050a49483e1af7395e2571e56202e54843cbfccff3550eba6cb2f389ad9b59f1a8ab61b7e5ebcf588c0580d6028
-
SSDEEP
12288:HU5rCOTeiJ3terwhsU7Sxn32Vuh7/E48NZ:HUQOJJ34bw47/E48N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4752 2FBB.tmp 1016 3018.tmp 5000 3076.tmp 3632 30E3.tmp 4376 3170.tmp 2560 31CE.tmp 4600 324B.tmp 1536 32B8.tmp 3708 3306.tmp 3252 3364.tmp 3480 33C2.tmp 2872 3420.tmp 4864 347D.tmp 3952 34CB.tmp 1396 351A.tmp 2040 3568.tmp 3808 35B6.tmp 1520 3604.tmp 4264 3652.tmp 2624 36BF.tmp 3120 373C.tmp 4592 379A.tmp 4680 37E8.tmp 4552 3856.tmp 1748 38C3.tmp 2520 3911.tmp 3520 396F.tmp 4060 39BD.tmp 4640 3A2A.tmp 4024 3A88.tmp 3316 3AE6.tmp 2976 3B63.tmp 212 3BB1.tmp 1364 3BFF.tmp 4876 3C5D.tmp 4420 3CBB.tmp 4588 3D47.tmp 2692 3DB5.tmp 4312 3E12.tmp 3704 3E70.tmp 3068 3ECE.tmp 4296 3F1C.tmp 2460 3F6A.tmp 2252 3FB8.tmp 1224 4016.tmp 1160 4064.tmp 4760 40C2.tmp 2280 4120.tmp 4052 417D.tmp 3580 41DB.tmp 1648 4239.tmp 4208 4287.tmp 1776 42D5.tmp 4964 4323.tmp 3236 4381.tmp 5108 43DF.tmp 1676 443D.tmp 3356 449A.tmp 4040 44E8.tmp 4608 4546.tmp 1912 45A4.tmp 964 4611.tmp 2520 466F.tmp 3492 46CD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 4752 2692 2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe 83 PID 2692 wrote to memory of 4752 2692 2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe 83 PID 2692 wrote to memory of 4752 2692 2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe 83 PID 4752 wrote to memory of 1016 4752 2FBB.tmp 84 PID 4752 wrote to memory of 1016 4752 2FBB.tmp 84 PID 4752 wrote to memory of 1016 4752 2FBB.tmp 84 PID 1016 wrote to memory of 5000 1016 3018.tmp 85 PID 1016 wrote to memory of 5000 1016 3018.tmp 85 PID 1016 wrote to memory of 5000 1016 3018.tmp 85 PID 5000 wrote to memory of 3632 5000 3076.tmp 86 PID 5000 wrote to memory of 3632 5000 3076.tmp 86 PID 5000 wrote to memory of 3632 5000 3076.tmp 86 PID 3632 wrote to memory of 4376 3632 30E3.tmp 87 PID 3632 wrote to memory of 4376 3632 30E3.tmp 87 PID 3632 wrote to memory of 4376 3632 30E3.tmp 87 PID 4376 wrote to memory of 2560 4376 3170.tmp 89 PID 4376 wrote to memory of 2560 4376 3170.tmp 89 PID 4376 wrote to memory of 2560 4376 3170.tmp 89 PID 2560 wrote to memory of 4600 2560 31CE.tmp 91 PID 2560 wrote to memory of 4600 2560 31CE.tmp 91 PID 2560 wrote to memory of 4600 2560 31CE.tmp 91 PID 4600 wrote to memory of 1536 4600 324B.tmp 93 PID 4600 wrote to memory of 1536 4600 324B.tmp 93 PID 4600 wrote to memory of 1536 4600 324B.tmp 93 PID 1536 wrote to memory of 3708 1536 32B8.tmp 94 PID 1536 wrote to memory of 3708 1536 32B8.tmp 94 PID 1536 wrote to memory of 3708 1536 32B8.tmp 94 PID 3708 wrote to memory of 3252 3708 3306.tmp 95 PID 3708 wrote to memory of 3252 3708 3306.tmp 95 PID 3708 wrote to memory of 3252 3708 3306.tmp 95 PID 3252 wrote to memory of 3480 3252 3364.tmp 96 PID 3252 wrote to memory of 3480 3252 3364.tmp 96 PID 3252 wrote to memory of 3480 3252 3364.tmp 96 PID 3480 wrote to memory of 2872 3480 33C2.tmp 97 PID 3480 wrote to memory of 2872 3480 33C2.tmp 97 PID 3480 wrote to memory of 2872 3480 33C2.tmp 97 PID 2872 wrote to memory of 4864 2872 3420.tmp 98 PID 2872 wrote to memory of 4864 2872 3420.tmp 98 PID 2872 wrote to memory of 4864 2872 3420.tmp 98 PID 4864 wrote to memory of 3952 4864 347D.tmp 99 PID 4864 wrote to memory of 3952 4864 347D.tmp 99 PID 4864 wrote to memory of 3952 4864 347D.tmp 99 PID 3952 wrote to memory of 1396 3952 34CB.tmp 100 PID 3952 wrote to memory of 1396 3952 34CB.tmp 100 PID 3952 wrote to memory of 1396 3952 34CB.tmp 100 PID 1396 wrote to memory of 2040 1396 351A.tmp 101 PID 1396 wrote to memory of 2040 1396 351A.tmp 101 PID 1396 wrote to memory of 2040 1396 351A.tmp 101 PID 2040 wrote to memory of 3808 2040 3568.tmp 102 PID 2040 wrote to memory of 3808 2040 3568.tmp 102 PID 2040 wrote to memory of 3808 2040 3568.tmp 102 PID 3808 wrote to memory of 1520 3808 35B6.tmp 103 PID 3808 wrote to memory of 1520 3808 35B6.tmp 103 PID 3808 wrote to memory of 1520 3808 35B6.tmp 103 PID 1520 wrote to memory of 4264 1520 3604.tmp 104 PID 1520 wrote to memory of 4264 1520 3604.tmp 104 PID 1520 wrote to memory of 4264 1520 3604.tmp 104 PID 4264 wrote to memory of 2624 4264 3652.tmp 105 PID 4264 wrote to memory of 2624 4264 3652.tmp 105 PID 4264 wrote to memory of 2624 4264 3652.tmp 105 PID 2624 wrote to memory of 3120 2624 36BF.tmp 106 PID 2624 wrote to memory of 3120 2624 36BF.tmp 106 PID 2624 wrote to memory of 3120 2624 36BF.tmp 106 PID 3120 wrote to memory of 4592 3120 373C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_608895657b3bd9e47f64b6f33414a02a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"C:\Users\Admin\AppData\Local\Temp\2FBB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3018.tmp"C:\Users\Admin\AppData\Local\Temp\3018.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\31CE.tmp"C:\Users\Admin\AppData\Local\Temp\31CE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"23⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"24⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"25⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"26⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"27⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"28⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"29⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"30⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"31⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"32⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"33⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"34⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"35⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"36⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"37⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"38⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"39⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"40⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"41⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"42⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"43⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"44⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"45⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"46⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"47⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"48⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"49⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"50⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"51⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"52⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"53⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"54⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"55⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"56⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"57⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"58⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"59⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"60⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"61⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"62⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"63⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"64⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"65⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"66⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"67⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"68⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"69⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"70⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"71⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"72⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"73⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"74⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"75⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"76⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"77⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"78⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"79⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"81⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"82⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"83⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"84⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"85⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"86⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"87⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"88⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"89⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"90⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"91⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"93⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"94⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"95⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"96⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"97⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"98⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"99⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"101⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"102⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"103⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"104⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"105⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"106⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"107⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"108⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"109⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"110⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"111⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"112⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"113⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"115⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"116⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"117⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"118⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"119⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"120⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"121⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"122⤵PID:1140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-