Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe
-
Size
541KB
-
MD5
e928508e93677d539a1c926ff450f4e0
-
SHA1
9c9a0f1ef4a98e58bc995e856a1186bddca1c1ca
-
SHA256
39a6244379decaab6fe03e323bb59f2979dd553b896974115c001239fcd5047c
-
SHA512
d1170098865a7b54115f2c8bea0de63d0892c27c9ccb244badf3fb77d6b82f5b0cde8d6672d50fdaeedf5596ed020cd4f987e1c1b51dc3fe2f0c2e37724d75df
-
SSDEEP
12288:UU5rCOTeifF78Zbe6drmGL7awineGyW/XrZa73ctO:UUQOJfF78ZzNna3v7XrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4152 2D98.tmp 2164 2E34.tmp 3172 2E82.tmp 4280 2EEF.tmp 536 2F4D.tmp 2220 2FCA.tmp 3632 3028.tmp 1640 30A5.tmp 1728 30F3.tmp 8 3151.tmp 4852 31AF.tmp 772 321C.tmp 1500 3289.tmp 4068 32E7.tmp 4436 3335.tmp 3048 33B2.tmp 636 3400.tmp 4656 346E.tmp 3584 34BC.tmp 888 3539.tmp 4420 3597.tmp 4816 3604.tmp 3540 3652.tmp 2320 36B0.tmp 2896 371D.tmp 5008 376B.tmp 3836 37B9.tmp 5044 3827.tmp 624 3894.tmp 1656 3902.tmp 2352 398E.tmp 2732 39FC.tmp 1052 3A69.tmp 3220 3AE6.tmp 2264 3B34.tmp 4324 3B82.tmp 4512 3BE0.tmp 4356 3C4D.tmp 2044 3C9B.tmp 4964 3CF9.tmp 4836 3D57.tmp 3364 3DA5.tmp 5112 3DF3.tmp 436 3E41.tmp 3460 3E8F.tmp 4676 3EDE.tmp 2612 3F2C.tmp 2880 3F7A.tmp 4288 3FC8.tmp 2360 4016.tmp 1196 4064.tmp 1520 40C2.tmp 4572 4110.tmp 4400 416E.tmp 3912 41CC.tmp 4436 4229.tmp 1824 4277.tmp 912 42D5.tmp 4788 4323.tmp 4880 4381.tmp 1404 43DF.tmp 1264 442D.tmp 3616 447B.tmp 4816 44C9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 4152 2184 2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe 83 PID 2184 wrote to memory of 4152 2184 2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe 83 PID 2184 wrote to memory of 4152 2184 2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe 83 PID 4152 wrote to memory of 2164 4152 2D98.tmp 84 PID 4152 wrote to memory of 2164 4152 2D98.tmp 84 PID 4152 wrote to memory of 2164 4152 2D98.tmp 84 PID 2164 wrote to memory of 3172 2164 2E34.tmp 85 PID 2164 wrote to memory of 3172 2164 2E34.tmp 85 PID 2164 wrote to memory of 3172 2164 2E34.tmp 85 PID 3172 wrote to memory of 4280 3172 2E82.tmp 86 PID 3172 wrote to memory of 4280 3172 2E82.tmp 86 PID 3172 wrote to memory of 4280 3172 2E82.tmp 86 PID 4280 wrote to memory of 536 4280 2EEF.tmp 88 PID 4280 wrote to memory of 536 4280 2EEF.tmp 88 PID 4280 wrote to memory of 536 4280 2EEF.tmp 88 PID 536 wrote to memory of 2220 536 2F4D.tmp 90 PID 536 wrote to memory of 2220 536 2F4D.tmp 90 PID 536 wrote to memory of 2220 536 2F4D.tmp 90 PID 2220 wrote to memory of 3632 2220 2FCA.tmp 91 PID 2220 wrote to memory of 3632 2220 2FCA.tmp 91 PID 2220 wrote to memory of 3632 2220 2FCA.tmp 91 PID 3632 wrote to memory of 1640 3632 3028.tmp 93 PID 3632 wrote to memory of 1640 3632 3028.tmp 93 PID 3632 wrote to memory of 1640 3632 3028.tmp 93 PID 1640 wrote to memory of 1728 1640 30A5.tmp 94 PID 1640 wrote to memory of 1728 1640 30A5.tmp 94 PID 1640 wrote to memory of 1728 1640 30A5.tmp 94 PID 1728 wrote to memory of 8 1728 30F3.tmp 95 PID 1728 wrote to memory of 8 1728 30F3.tmp 95 PID 1728 wrote to memory of 8 1728 30F3.tmp 95 PID 8 wrote to memory of 4852 8 3151.tmp 96 PID 8 wrote to memory of 4852 8 3151.tmp 96 PID 8 wrote to memory of 4852 8 3151.tmp 96 PID 4852 wrote to memory of 772 4852 31AF.tmp 97 PID 4852 wrote to memory of 772 4852 31AF.tmp 97 PID 4852 wrote to memory of 772 4852 31AF.tmp 97 PID 772 wrote to memory of 1500 772 321C.tmp 98 PID 772 wrote to memory of 1500 772 321C.tmp 98 PID 772 wrote to memory of 1500 772 321C.tmp 98 PID 1500 wrote to memory of 4068 1500 3289.tmp 99 PID 1500 wrote to memory of 4068 1500 3289.tmp 99 PID 1500 wrote to memory of 4068 1500 3289.tmp 99 PID 4068 wrote to memory of 4436 4068 32E7.tmp 100 PID 4068 wrote to memory of 4436 4068 32E7.tmp 100 PID 4068 wrote to memory of 4436 4068 32E7.tmp 100 PID 4436 wrote to memory of 3048 4436 3335.tmp 101 PID 4436 wrote to memory of 3048 4436 3335.tmp 101 PID 4436 wrote to memory of 3048 4436 3335.tmp 101 PID 3048 wrote to memory of 636 3048 33B2.tmp 102 PID 3048 wrote to memory of 636 3048 33B2.tmp 102 PID 3048 wrote to memory of 636 3048 33B2.tmp 102 PID 636 wrote to memory of 4656 636 3400.tmp 103 PID 636 wrote to memory of 4656 636 3400.tmp 103 PID 636 wrote to memory of 4656 636 3400.tmp 103 PID 4656 wrote to memory of 3584 4656 346E.tmp 104 PID 4656 wrote to memory of 3584 4656 346E.tmp 104 PID 4656 wrote to memory of 3584 4656 346E.tmp 104 PID 3584 wrote to memory of 888 3584 34BC.tmp 105 PID 3584 wrote to memory of 888 3584 34BC.tmp 105 PID 3584 wrote to memory of 888 3584 34BC.tmp 105 PID 888 wrote to memory of 4420 888 3539.tmp 106 PID 888 wrote to memory of 4420 888 3539.tmp 106 PID 888 wrote to memory of 4420 888 3539.tmp 106 PID 4420 wrote to memory of 4816 4420 3597.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_e928508e93677d539a1c926ff450f4e0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2D98.tmp"C:\Users\Admin\AppData\Local\Temp\2D98.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\2E34.tmp"C:\Users\Admin\AppData\Local\Temp\2E34.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2E82.tmp"C:\Users\Admin\AppData\Local\Temp\2E82.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"C:\Users\Admin\AppData\Local\Temp\2F4D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"C:\Users\Admin\AppData\Local\Temp\2FCA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3028.tmp"C:\Users\Admin\AppData\Local\Temp\3028.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\30F3.tmp"C:\Users\Admin\AppData\Local\Temp\30F3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\31AF.tmp"C:\Users\Admin\AppData\Local\Temp\31AF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"23⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"24⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"25⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"26⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"27⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"28⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"29⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"30⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"31⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"32⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"33⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"34⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"35⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"36⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"37⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"38⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"39⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"40⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"41⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"42⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"43⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"44⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"45⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"46⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"47⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"48⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"49⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"50⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"51⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"52⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"53⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"54⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"55⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"56⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"57⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"58⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"59⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"60⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"61⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"62⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"63⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"64⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"65⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"66⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"67⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"68⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"69⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"70⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"72⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"73⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"74⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"75⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"76⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"77⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"78⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"79⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"80⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"81⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"82⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"83⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"84⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"85⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"86⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"87⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"88⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"89⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"90⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"92⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"93⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"94⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"96⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"97⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"98⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"99⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"100⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"101⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"102⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"103⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"104⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"105⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"106⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"107⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"108⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"109⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"110⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"111⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"112⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"113⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"114⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"115⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"116⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"117⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"118⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"119⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"120⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"121⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-