Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe
-
Size
541KB
-
MD5
76b45b3b869eb4842bc819eeb796800f
-
SHA1
7f9824da3ba7a27cb9764070fceac3a654b790f7
-
SHA256
b8c9595f6ab119021e0c2f1f42ced7bd6c902c5dd02093d6f70d0640cd629b09
-
SHA512
01abc77f2531438f2f68adb8d3095c497a584b2fcb9e0ba776b570c30aec65d97ad0c2df11fa17ff246c6d3aade3992a0e6e2358e5946963391c86c180d85247
-
SSDEEP
12288:UU5rCOTeifhfbqVDzemJEKyC/Hd80n9rZa73ctO:UUQOJfyuOEVC/Hd8k9rU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
3597.tmp3614.tmp3681.tmp36DF.tmp373C.tmp379A.tmp37F8.tmp3856.tmp38A4.tmp3902.tmp396F.tmp39CD.tmp3A2A.tmp3AA7.tmp3AF6.tmp3B63.tmp3BD0.tmp3C2E.tmp3C8C.tmp3D09.tmp3D67.tmp3DD4.tmp3E32.tmp3E9F.tmp3F1C.tmp3F6A.tmp3FB8.tmp4006.tmp4074.tmp40C2.tmp4120.tmp417D.tmp41EB.tmp4239.tmp4287.tmp42D5.tmp4323.tmp4371.tmp43CF.tmp441D.tmp446B.tmp44C9.tmp4527.tmp4575.tmp45C3.tmp4611.tmp465F.tmp46AE.tmp46FC.tmp474A.tmp4798.tmp47E6.tmp4834.tmp4882.tmp48E0.tmp493E.tmp499C.tmp49F9.tmp4A47.tmp4A96.tmp4AE4.tmp4B41.tmp4B90.tmp4BED.tmppid process 4004 3597.tmp 4056 3614.tmp 5048 3681.tmp 5000 36DF.tmp 5008 373C.tmp 1928 379A.tmp 4496 37F8.tmp 2064 3856.tmp 4080 38A4.tmp 2860 3902.tmp 4804 396F.tmp 1420 39CD.tmp 1872 3A2A.tmp 2376 3AA7.tmp 1892 3AF6.tmp 1784 3B63.tmp 2148 3BD0.tmp 3044 3C2E.tmp 3064 3C8C.tmp 3252 3D09.tmp 4100 3D67.tmp 3828 3DD4.tmp 3144 3E32.tmp 3424 3E9F.tmp 4500 3F1C.tmp 3408 3F6A.tmp 4588 3FB8.tmp 4372 4006.tmp 2896 4074.tmp 1752 40C2.tmp 5016 4120.tmp 892 417D.tmp 4004 41EB.tmp 3724 4239.tmp 1956 4287.tmp 4468 42D5.tmp 3736 4323.tmp 4356 4371.tmp 3300 43CF.tmp 4828 441D.tmp 4080 446B.tmp 1444 44C9.tmp 3872 4527.tmp 2904 4575.tmp 3204 45C3.tmp 2208 4611.tmp 824 465F.tmp 2772 46AE.tmp 2228 46FC.tmp 4632 474A.tmp 2512 4798.tmp 3720 47E6.tmp 3440 4834.tmp 3692 4882.tmp 1620 48E0.tmp 3252 493E.tmp 3540 499C.tmp 1344 49F9.tmp 1820 4A47.tmp 2096 4A96.tmp 4392 4AE4.tmp 4224 4B41.tmp 2312 4B90.tmp 2700 4BED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe3597.tmp3614.tmp3681.tmp36DF.tmp373C.tmp379A.tmp37F8.tmp3856.tmp38A4.tmp3902.tmp396F.tmp39CD.tmp3A2A.tmp3AA7.tmp3AF6.tmp3B63.tmp3BD0.tmp3C2E.tmp3C8C.tmp3D09.tmp3D67.tmpdescription pid process target process PID 4180 wrote to memory of 4004 4180 2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe 3597.tmp PID 4180 wrote to memory of 4004 4180 2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe 3597.tmp PID 4180 wrote to memory of 4004 4180 2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe 3597.tmp PID 4004 wrote to memory of 4056 4004 3597.tmp 3614.tmp PID 4004 wrote to memory of 4056 4004 3597.tmp 3614.tmp PID 4004 wrote to memory of 4056 4004 3597.tmp 3614.tmp PID 4056 wrote to memory of 5048 4056 3614.tmp 3681.tmp PID 4056 wrote to memory of 5048 4056 3614.tmp 3681.tmp PID 4056 wrote to memory of 5048 4056 3614.tmp 3681.tmp PID 5048 wrote to memory of 5000 5048 3681.tmp 36DF.tmp PID 5048 wrote to memory of 5000 5048 3681.tmp 36DF.tmp PID 5048 wrote to memory of 5000 5048 3681.tmp 36DF.tmp PID 5000 wrote to memory of 5008 5000 36DF.tmp 373C.tmp PID 5000 wrote to memory of 5008 5000 36DF.tmp 373C.tmp PID 5000 wrote to memory of 5008 5000 36DF.tmp 373C.tmp PID 5008 wrote to memory of 1928 5008 373C.tmp 379A.tmp PID 5008 wrote to memory of 1928 5008 373C.tmp 379A.tmp PID 5008 wrote to memory of 1928 5008 373C.tmp 379A.tmp PID 1928 wrote to memory of 4496 1928 379A.tmp 37F8.tmp PID 1928 wrote to memory of 4496 1928 379A.tmp 37F8.tmp PID 1928 wrote to memory of 4496 1928 379A.tmp 37F8.tmp PID 4496 wrote to memory of 2064 4496 37F8.tmp 3856.tmp PID 4496 wrote to memory of 2064 4496 37F8.tmp 3856.tmp PID 4496 wrote to memory of 2064 4496 37F8.tmp 3856.tmp PID 2064 wrote to memory of 4080 2064 3856.tmp 38A4.tmp PID 2064 wrote to memory of 4080 2064 3856.tmp 38A4.tmp PID 2064 wrote to memory of 4080 2064 3856.tmp 38A4.tmp PID 4080 wrote to memory of 2860 4080 38A4.tmp 3902.tmp PID 4080 wrote to memory of 2860 4080 38A4.tmp 3902.tmp PID 4080 wrote to memory of 2860 4080 38A4.tmp 3902.tmp PID 2860 wrote to memory of 4804 2860 3902.tmp 396F.tmp PID 2860 wrote to memory of 4804 2860 3902.tmp 396F.tmp PID 2860 wrote to memory of 4804 2860 3902.tmp 396F.tmp PID 4804 wrote to memory of 1420 4804 396F.tmp 39CD.tmp PID 4804 wrote to memory of 1420 4804 396F.tmp 39CD.tmp PID 4804 wrote to memory of 1420 4804 396F.tmp 39CD.tmp PID 1420 wrote to memory of 1872 1420 39CD.tmp 3A2A.tmp PID 1420 wrote to memory of 1872 1420 39CD.tmp 3A2A.tmp PID 1420 wrote to memory of 1872 1420 39CD.tmp 3A2A.tmp PID 1872 wrote to memory of 2376 1872 3A2A.tmp 3AA7.tmp PID 1872 wrote to memory of 2376 1872 3A2A.tmp 3AA7.tmp PID 1872 wrote to memory of 2376 1872 3A2A.tmp 3AA7.tmp PID 2376 wrote to memory of 1892 2376 3AA7.tmp 3AF6.tmp PID 2376 wrote to memory of 1892 2376 3AA7.tmp 3AF6.tmp PID 2376 wrote to memory of 1892 2376 3AA7.tmp 3AF6.tmp PID 1892 wrote to memory of 1784 1892 3AF6.tmp 3B63.tmp PID 1892 wrote to memory of 1784 1892 3AF6.tmp 3B63.tmp PID 1892 wrote to memory of 1784 1892 3AF6.tmp 3B63.tmp PID 1784 wrote to memory of 2148 1784 3B63.tmp 3BD0.tmp PID 1784 wrote to memory of 2148 1784 3B63.tmp 3BD0.tmp PID 1784 wrote to memory of 2148 1784 3B63.tmp 3BD0.tmp PID 2148 wrote to memory of 3044 2148 3BD0.tmp 3C2E.tmp PID 2148 wrote to memory of 3044 2148 3BD0.tmp 3C2E.tmp PID 2148 wrote to memory of 3044 2148 3BD0.tmp 3C2E.tmp PID 3044 wrote to memory of 3064 3044 3C2E.tmp 3C8C.tmp PID 3044 wrote to memory of 3064 3044 3C2E.tmp 3C8C.tmp PID 3044 wrote to memory of 3064 3044 3C2E.tmp 3C8C.tmp PID 3064 wrote to memory of 3252 3064 3C8C.tmp 3D09.tmp PID 3064 wrote to memory of 3252 3064 3C8C.tmp 3D09.tmp PID 3064 wrote to memory of 3252 3064 3C8C.tmp 3D09.tmp PID 3252 wrote to memory of 4100 3252 3D09.tmp 3D67.tmp PID 3252 wrote to memory of 4100 3252 3D09.tmp 3D67.tmp PID 3252 wrote to memory of 4100 3252 3D09.tmp 3D67.tmp PID 4100 wrote to memory of 3828 4100 3D67.tmp 3DD4.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_76b45b3b869eb4842bc819eeb796800f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"23⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"24⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"25⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"26⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"27⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"29⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"30⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"31⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"32⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"33⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"34⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"35⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"36⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"37⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"38⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"39⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"40⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"41⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"42⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"43⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"44⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"45⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"46⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"47⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"48⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"49⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"50⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"51⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"52⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"53⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"54⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"55⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"56⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"57⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"58⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"59⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"60⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"61⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"62⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"63⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"64⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"65⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"66⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"67⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"68⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"69⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"70⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"71⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"72⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"73⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"74⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"75⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"76⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"77⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"78⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"79⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"80⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"81⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"82⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"83⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"84⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"85⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"86⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"87⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"88⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"89⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"90⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"91⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"92⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"93⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"94⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"95⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"96⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"97⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"98⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"99⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"100⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"101⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"102⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"103⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"104⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"105⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"106⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"107⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"108⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"109⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"110⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"111⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"112⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"113⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"114⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"115⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"116⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"117⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"118⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"119⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"121⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"122⤵PID:208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-