Analysis
- max time kernel
151s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
- Target 2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe
- Size 486KB
- Sample240517-qs92maag73
- SHA256 18bdb6411f032bcc1017114dfd517ebeb0ee6144f7d1330c888ccab465852d89
- MD5 97c1cf88f1d3038ce2c38c89f2cacdeb
- SHA1 5a39ee65ce0d6e03d426a50b0a854b6f118a3b58
- SHA512 c9404be8a90794d32a0dadf7c4c08dd2e463aeadf4135dfeec72a0e00217bdc66871dc3b5323b6acc6fab3a7eb1a667b7656bddc9ed620ffaae3dadfb6dc73b5
- SSDEEP 12288:/U5rCOTeiDoubqkK3QA6Ip1ZX4SbBfeINZ:/UQOJD/TAF7Z4GfTN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5004 D97.tmp 4052 EFF.tmp 1996 FCA.tmp 4876 10A5.tmp 2628 117F.tmp 1376 126A.tmp 3036 13E1.tmp 3380 14AC.tmp 3420 15A6.tmp 2452 16CF.tmp 840 17AA.tmp 4304 1875.tmp 4548 1930.tmp 2400 19CC.tmp 1748 1E9F.tmp 1368 1F6A.tmp 1840 21DB.tmp 1848 22E5.tmp 1200 2371.tmp 1944 243C.tmp 1684 2517.tmp 1448 25D3.tmp 3140 266F.tmp 4352 2778.tmp 3516 2872.tmp 3568 292E.tmp 4284 2A09.tmp 4976 2AE3.tmp 1104 2B9F.tmp 4888 2C3B.tmp 1384 2CD7.tmp 4112 2D93.tmp 4744 2E20.tmp 2260 2EAC.tmp 3556 2F1A.tmp 3920 2F97.tmp 4016 3004.tmp 4292 3091.tmp 4984 311D.tmp 4884 31B9.tmp 5112 3236.tmp 4520 32C3.tmp 736 335F.tmp 4196 33CD.tmp 4220 3459.tmp 4320 34E6.tmp 4956 35FF.tmp 3996 368C.tmp 3484 36F9.tmp 5092 3776.tmp 3380 3812.tmp 3648 389F.tmp 1920 392C.tmp 2796 39C8.tmp 4412 3A64.tmp 4548 3AD2.tmp 2968 3B6E.tmp 2384 3BDB.tmp 3132 3C58.tmp 3500 3CE5.tmp 3180 3D71.tmp 1840 3DFE.tmp 3772 3ED9.tmp 2404 3F65.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 5004 5112 2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe 91 PID 5112 wrote to memory of 5004 5112 2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe 91 PID 5112 wrote to memory of 5004 5112 2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe 91 PID 5004 wrote to memory of 4052 5004 D97.tmp 92 PID 5004 wrote to memory of 4052 5004 D97.tmp 92 PID 5004 wrote to memory of 4052 5004 D97.tmp 92 PID 4052 wrote to memory of 1996 4052 EFF.tmp 93 PID 4052 wrote to memory of 1996 4052 EFF.tmp 93 PID 4052 wrote to memory of 1996 4052 EFF.tmp 93 PID 1996 wrote to memory of 4876 1996 FCA.tmp 94 PID 1996 wrote to memory of 4876 1996 FCA.tmp 94 PID 1996 wrote to memory of 4876 1996 FCA.tmp 94 PID 4876 wrote to memory of 2628 4876 10A5.tmp 95 PID 4876 wrote to memory of 2628 4876 10A5.tmp 95 PID 4876 wrote to memory of 2628 4876 10A5.tmp 95 PID 2628 wrote to memory of 1376 2628 117F.tmp 96 PID 2628 wrote to memory of 1376 2628 117F.tmp 96 PID 2628 wrote to memory of 1376 2628 117F.tmp 96 PID 1376 wrote to memory of 3036 1376 126A.tmp 97 PID 1376 wrote to memory of 3036 1376 126A.tmp 97 PID 1376 wrote to memory of 3036 1376 126A.tmp 97 PID 3036 wrote to memory of 3380 3036 13E1.tmp 98 PID 3036 wrote to memory of 3380 3036 13E1.tmp 98 PID 3036 wrote to memory of 3380 3036 13E1.tmp 98 PID 3380 wrote to memory of 3420 3380 14AC.tmp 99 PID 3380 wrote to memory of 3420 3380 14AC.tmp 99 PID 3380 wrote to memory of 3420 3380 14AC.tmp 99 PID 3420 wrote to memory of 2452 3420 15A6.tmp 100 PID 3420 wrote to memory of 2452 3420 15A6.tmp 100 PID 3420 wrote to memory of 2452 3420 15A6.tmp 100 PID 2452 wrote to memory of 840 2452 16CF.tmp 101 PID 2452 wrote to memory of 840 2452 16CF.tmp 101 PID 2452 wrote to memory of 840 2452 16CF.tmp 101 PID 840 wrote to memory of 4304 840 17AA.tmp 102 PID 840 wrote to memory of 4304 840 17AA.tmp 102 PID 840 wrote to memory of 4304 840 17AA.tmp 102 PID 4304 wrote to memory of 4548 4304 1875.tmp 103 PID 4304 wrote to memory of 4548 4304 1875.tmp 103 PID 4304 wrote to memory of 4548 4304 1875.tmp 103 PID 4548 wrote to memory of 2400 4548 1930.tmp 104 PID 4548 wrote to memory of 2400 4548 1930.tmp 104 PID 4548 wrote to memory of 2400 4548 1930.tmp 104 PID 2400 wrote to memory of 1748 2400 19CC.tmp 105 PID 2400 wrote to memory of 1748 2400 19CC.tmp 105 PID 2400 wrote to memory of 1748 2400 19CC.tmp 105 PID 1748 wrote to memory of 1368 1748 1E9F.tmp 106 PID 1748 wrote to memory of 1368 1748 1E9F.tmp 106 PID 1748 wrote to memory of 1368 1748 1E9F.tmp 106 PID 1368 wrote to memory of 1840 1368 1F6A.tmp 107 PID 1368 wrote to memory of 1840 1368 1F6A.tmp 107 PID 1368 wrote to memory of 1840 1368 1F6A.tmp 107 PID 1840 wrote to memory of 1848 1840 21DB.tmp 108 PID 1840 wrote to memory of 1848 1840 21DB.tmp 108 PID 1840 wrote to memory of 1848 1840 21DB.tmp 108 PID 1848 wrote to memory of 1200 1848 22E5.tmp 109 PID 1848 wrote to memory of 1200 1848 22E5.tmp 109 PID 1848 wrote to memory of 1200 1848 22E5.tmp 109 PID 1200 wrote to memory of 1944 1200 2371.tmp 110 PID 1200 wrote to memory of 1944 1200 2371.tmp 110 PID 1200 wrote to memory of 1944 1200 2371.tmp 110 PID 1944 wrote to memory of 1684 1944 243C.tmp 111 PID 1944 wrote to memory of 1684 1944 243C.tmp 111 PID 1944 wrote to memory of 1684 1944 243C.tmp 111 PID 1684 wrote to memory of 1448 1684 2517.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_97c1cf88f1d3038ce2c38c89f2cacdeb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"23⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"24⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"25⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"26⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"27⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"28⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"29⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"30⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"31⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"32⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"33⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"34⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"35⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"36⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"37⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"38⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"39⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"40⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"41⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"42⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"43⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"44⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"45⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"46⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"47⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"48⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"49⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"50⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"51⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"52⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"53⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"54⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"55⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"56⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"57⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"58⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"59⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"60⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"61⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"62⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"63⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"64⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"65⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"66⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"67⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"68⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"69⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"70⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"71⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"72⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"73⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"74⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"75⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"76⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"77⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\46A9.tmp"C:\Users\Admin\AppData\Local\Temp\46A9.tmp"78⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"79⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"80⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"81⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"82⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"83⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"84⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"85⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"86⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"87⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"88⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"89⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"90⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"91⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"92⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"93⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"94⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"95⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"96⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"97⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"98⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"99⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"100⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"101⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"102⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"103⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"104⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"105⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"106⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"107⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"108⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"109⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"110⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"111⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"112⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"113⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"114⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"115⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"116⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"117⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"118⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"120⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"121⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"122⤵PID:932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-