Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe
-
Size
487KB
-
MD5
b5edde5d5401fe42d4da883eac17f089
-
SHA1
ee252b216248fb06376590aa15bc07336418d395
-
SHA256
c76e11c90dd105bb04cd0d0db67c2b185323633d5821129f988eed87ed7b967b
-
SHA512
e0e94eba8248f32a0dfc2bc1856da1772ac2839d9d3c7e3d2d67a2a75f05b21636e004dec029aa720e631d4c8c88b42b547289803cbc1c24bbc3d0853eb32d75
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUTkD46ij34ORWzqFrqfKrnpqhDDcI6qbeO9k5:HU5rCOTeiJKkkN3C0WynpqhDTEAeRNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2980 F1C2.tmp 2992 F359.tmp 1620 F4D0.tmp 4992 F59B.tmp 4696 F695.tmp 2032 FD2C.tmp 1692 FF7E.tmp 1948 E5.tmp 3768 23D.tmp 1456 337.tmp 3992 441.tmp 4276 4DD.tmp 1040 5E7.tmp 960 6C1.tmp 1900 77D.tmp 4076 848.tmp 1804 904.tmp 4216 990.tmp 2100 A4C.tmp 5080 B17.tmp 3804 BB3.tmp 2344 C9D.tmp 4556 D88.tmp 1104 E34.tmp 4980 F0E.tmp 2468 FDA.tmp 2408 10F3.tmp 3164 1170.tmp 2668 126A.tmp 768 12F6.tmp 1996 1393.tmp 1932 147D.tmp 4420 1567.tmp 2416 15F4.tmp 2960 1690.tmp 3684 173C.tmp 1936 17D8.tmp 4416 1865.tmp 4480 18F2.tmp 1188 196F.tmp 4736 1A2A.tmp 1272 1AA7.tmp 2216 1B63.tmp 1964 1BEF.tmp 116 1C8C.tmp 1408 1D09.tmp 1948 1D95.tmp 2972 1E03.tmp 3868 1E80.tmp 4064 1F1C.tmp 332 1F99.tmp 1040 2025.tmp 1792 2093.tmp 4928 214E.tmp 3704 21BC.tmp 4040 2258.tmp 3744 22D5.tmp 2712 2362.tmp 2788 23EE.tmp 2352 247B.tmp 3536 24F8.tmp 3260 2584.tmp 1104 2621.tmp 2388 26AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 2980 4544 2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe 91 PID 4544 wrote to memory of 2980 4544 2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe 91 PID 4544 wrote to memory of 2980 4544 2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe 91 PID 2980 wrote to memory of 2992 2980 F1C2.tmp 92 PID 2980 wrote to memory of 2992 2980 F1C2.tmp 92 PID 2980 wrote to memory of 2992 2980 F1C2.tmp 92 PID 2992 wrote to memory of 1620 2992 F359.tmp 93 PID 2992 wrote to memory of 1620 2992 F359.tmp 93 PID 2992 wrote to memory of 1620 2992 F359.tmp 93 PID 1620 wrote to memory of 4992 1620 F4D0.tmp 94 PID 1620 wrote to memory of 4992 1620 F4D0.tmp 94 PID 1620 wrote to memory of 4992 1620 F4D0.tmp 94 PID 4992 wrote to memory of 4696 4992 F59B.tmp 95 PID 4992 wrote to memory of 4696 4992 F59B.tmp 95 PID 4992 wrote to memory of 4696 4992 F59B.tmp 95 PID 4696 wrote to memory of 2032 4696 F695.tmp 96 PID 4696 wrote to memory of 2032 4696 F695.tmp 96 PID 4696 wrote to memory of 2032 4696 F695.tmp 96 PID 2032 wrote to memory of 1692 2032 FD2C.tmp 97 PID 2032 wrote to memory of 1692 2032 FD2C.tmp 97 PID 2032 wrote to memory of 1692 2032 FD2C.tmp 97 PID 1692 wrote to memory of 1948 1692 FF7E.tmp 98 PID 1692 wrote to memory of 1948 1692 FF7E.tmp 98 PID 1692 wrote to memory of 1948 1692 FF7E.tmp 98 PID 1948 wrote to memory of 3768 1948 E5.tmp 99 PID 1948 wrote to memory of 3768 1948 E5.tmp 99 PID 1948 wrote to memory of 3768 1948 E5.tmp 99 PID 3768 wrote to memory of 1456 3768 23D.tmp 100 PID 3768 wrote to memory of 1456 3768 23D.tmp 100 PID 3768 wrote to memory of 1456 3768 23D.tmp 100 PID 1456 wrote to memory of 3992 1456 337.tmp 101 PID 1456 wrote to memory of 3992 1456 337.tmp 101 PID 1456 wrote to memory of 3992 1456 337.tmp 101 PID 3992 wrote to memory of 4276 3992 441.tmp 102 PID 3992 wrote to memory of 4276 3992 441.tmp 102 PID 3992 wrote to memory of 4276 3992 441.tmp 102 PID 4276 wrote to memory of 1040 4276 4DD.tmp 103 PID 4276 wrote to memory of 1040 4276 4DD.tmp 103 PID 4276 wrote to memory of 1040 4276 4DD.tmp 103 PID 1040 wrote to memory of 960 1040 5E7.tmp 104 PID 1040 wrote to memory of 960 1040 5E7.tmp 104 PID 1040 wrote to memory of 960 1040 5E7.tmp 104 PID 960 wrote to memory of 1900 960 6C1.tmp 105 PID 960 wrote to memory of 1900 960 6C1.tmp 105 PID 960 wrote to memory of 1900 960 6C1.tmp 105 PID 1900 wrote to memory of 4076 1900 77D.tmp 106 PID 1900 wrote to memory of 4076 1900 77D.tmp 106 PID 1900 wrote to memory of 4076 1900 77D.tmp 106 PID 4076 wrote to memory of 1804 4076 848.tmp 107 PID 4076 wrote to memory of 1804 4076 848.tmp 107 PID 4076 wrote to memory of 1804 4076 848.tmp 107 PID 1804 wrote to memory of 4216 1804 904.tmp 108 PID 1804 wrote to memory of 4216 1804 904.tmp 108 PID 1804 wrote to memory of 4216 1804 904.tmp 108 PID 4216 wrote to memory of 2100 4216 990.tmp 109 PID 4216 wrote to memory of 2100 4216 990.tmp 109 PID 4216 wrote to memory of 2100 4216 990.tmp 109 PID 2100 wrote to memory of 5080 2100 A4C.tmp 110 PID 2100 wrote to memory of 5080 2100 A4C.tmp 110 PID 2100 wrote to memory of 5080 2100 A4C.tmp 110 PID 5080 wrote to memory of 3804 5080 B17.tmp 111 PID 5080 wrote to memory of 3804 5080 B17.tmp 111 PID 5080 wrote to memory of 3804 5080 B17.tmp 111 PID 3804 wrote to memory of 2344 3804 BB3.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_b5edde5d5401fe42d4da883eac17f089_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"23⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"24⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"25⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"26⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"27⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"28⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"29⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"30⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"31⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"32⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"33⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"34⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"35⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"36⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"37⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"38⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"39⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"40⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"41⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"42⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"43⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"44⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"45⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"46⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"47⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"48⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"49⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"50⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"51⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"52⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"53⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"54⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"55⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"56⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"57⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"58⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"59⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"60⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"61⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"62⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"63⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"64⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"65⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"66⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"67⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"68⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"70⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"71⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"72⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"73⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"74⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"75⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"76⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"77⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"78⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"79⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"80⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"81⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"82⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"83⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"84⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"85⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"86⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"87⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"88⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"89⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"90⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"91⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"92⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"93⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"94⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"95⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"96⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"97⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"98⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"99⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"100⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"101⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"102⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"103⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"104⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"105⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"106⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"107⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"108⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"109⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"110⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"111⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"112⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"113⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"114⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"115⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"116⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"117⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"118⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"119⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"120⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"121⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"122⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-