Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe
-
Size
520KB
-
MD5
674e5590750298981bd63d83ed79b531
-
SHA1
746d57653c14216368d0b9feb07be21f4ba4cb43
-
SHA256
f50014e7a82848750c1978e0413afe139a3d65a0e8fa7ba1466570ebddbc5aa6
-
SHA512
e25713fd3bcad4f98c8e0a7ac921a7162fb41d553f8ebf9947af50cc2d52515e6f3e527fa9337c972ed84fa682c7a92befb3aa38596b84e116b9f3e4041130f0
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLDIFXUqUkRaevhCIcbRfRE3/FV1O28sUQVQ4OC:roRXOQjmOyOXU7kkxdK39jIspyqNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1464 326A.tmp 3208 32D7.tmp 736 3345.tmp 4596 33A3.tmp 2392 3400.tmp 3512 346E.tmp 1052 34BC.tmp 220 350A.tmp 1892 3587.tmp 3096 35F4.tmp 4408 3662.tmp 3144 36B0.tmp 4804 371D.tmp 392 378B.tmp 3908 37D9.tmp 3168 3827.tmp 1968 38A4.tmp 4228 3930.tmp 852 398E.tmp 3748 39DC.tmp 2024 3A4A.tmp 4620 3AA7.tmp 3080 3AF6.tmp 2524 3B63.tmp 3520 3BE0.tmp 3468 3C5D.tmp 4896 3CDA.tmp 4256 3D47.tmp 3316 3D95.tmp 2436 3DF3.tmp 1632 3E51.tmp 2928 3EBE.tmp 1104 3F1C.tmp 1944 3F6A.tmp 3704 3FB8.tmp 4636 4006.tmp 3544 4055.tmp 4644 40B2.tmp 5060 4100.tmp 1916 414F.tmp 216 419D.tmp 5064 41EB.tmp 3648 4249.tmp 4952 4297.tmp 3116 42E5.tmp 2992 4333.tmp 636 43EE.tmp 4580 443D.tmp 1576 449A.tmp 3964 44F8.tmp 3972 4556.tmp 976 45B4.tmp 3020 4611.tmp 5088 466F.tmp 3396 46CD.tmp 8 471B.tmp 2740 4779.tmp 2724 47C7.tmp 4484 4815.tmp 5112 4863.tmp 1956 48C1.tmp 2132 491F.tmp 3668 496D.tmp 2128 49BB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 1464 636 2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe 81 PID 636 wrote to memory of 1464 636 2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe 81 PID 636 wrote to memory of 1464 636 2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe 81 PID 1464 wrote to memory of 3208 1464 326A.tmp 82 PID 1464 wrote to memory of 3208 1464 326A.tmp 82 PID 1464 wrote to memory of 3208 1464 326A.tmp 82 PID 3208 wrote to memory of 736 3208 32D7.tmp 84 PID 3208 wrote to memory of 736 3208 32D7.tmp 84 PID 3208 wrote to memory of 736 3208 32D7.tmp 84 PID 736 wrote to memory of 4596 736 3345.tmp 85 PID 736 wrote to memory of 4596 736 3345.tmp 85 PID 736 wrote to memory of 4596 736 3345.tmp 85 PID 4596 wrote to memory of 2392 4596 33A3.tmp 87 PID 4596 wrote to memory of 2392 4596 33A3.tmp 87 PID 4596 wrote to memory of 2392 4596 33A3.tmp 87 PID 2392 wrote to memory of 3512 2392 3400.tmp 89 PID 2392 wrote to memory of 3512 2392 3400.tmp 89 PID 2392 wrote to memory of 3512 2392 3400.tmp 89 PID 3512 wrote to memory of 1052 3512 346E.tmp 90 PID 3512 wrote to memory of 1052 3512 346E.tmp 90 PID 3512 wrote to memory of 1052 3512 346E.tmp 90 PID 1052 wrote to memory of 220 1052 34BC.tmp 91 PID 1052 wrote to memory of 220 1052 34BC.tmp 91 PID 1052 wrote to memory of 220 1052 34BC.tmp 91 PID 220 wrote to memory of 1892 220 350A.tmp 92 PID 220 wrote to memory of 1892 220 350A.tmp 92 PID 220 wrote to memory of 1892 220 350A.tmp 92 PID 1892 wrote to memory of 3096 1892 3587.tmp 93 PID 1892 wrote to memory of 3096 1892 3587.tmp 93 PID 1892 wrote to memory of 3096 1892 3587.tmp 93 PID 3096 wrote to memory of 4408 3096 35F4.tmp 94 PID 3096 wrote to memory of 4408 3096 35F4.tmp 94 PID 3096 wrote to memory of 4408 3096 35F4.tmp 94 PID 4408 wrote to memory of 3144 4408 3662.tmp 95 PID 4408 wrote to memory of 3144 4408 3662.tmp 95 PID 4408 wrote to memory of 3144 4408 3662.tmp 95 PID 3144 wrote to memory of 4804 3144 36B0.tmp 96 PID 3144 wrote to memory of 4804 3144 36B0.tmp 96 PID 3144 wrote to memory of 4804 3144 36B0.tmp 96 PID 4804 wrote to memory of 392 4804 371D.tmp 97 PID 4804 wrote to memory of 392 4804 371D.tmp 97 PID 4804 wrote to memory of 392 4804 371D.tmp 97 PID 392 wrote to memory of 3908 392 378B.tmp 98 PID 392 wrote to memory of 3908 392 378B.tmp 98 PID 392 wrote to memory of 3908 392 378B.tmp 98 PID 3908 wrote to memory of 3168 3908 37D9.tmp 99 PID 3908 wrote to memory of 3168 3908 37D9.tmp 99 PID 3908 wrote to memory of 3168 3908 37D9.tmp 99 PID 3168 wrote to memory of 1968 3168 3827.tmp 100 PID 3168 wrote to memory of 1968 3168 3827.tmp 100 PID 3168 wrote to memory of 1968 3168 3827.tmp 100 PID 1968 wrote to memory of 4228 1968 38A4.tmp 101 PID 1968 wrote to memory of 4228 1968 38A4.tmp 101 PID 1968 wrote to memory of 4228 1968 38A4.tmp 101 PID 4228 wrote to memory of 852 4228 3930.tmp 102 PID 4228 wrote to memory of 852 4228 3930.tmp 102 PID 4228 wrote to memory of 852 4228 3930.tmp 102 PID 852 wrote to memory of 3748 852 398E.tmp 103 PID 852 wrote to memory of 3748 852 398E.tmp 103 PID 852 wrote to memory of 3748 852 398E.tmp 103 PID 3748 wrote to memory of 2024 3748 39DC.tmp 104 PID 3748 wrote to memory of 2024 3748 39DC.tmp 104 PID 3748 wrote to memory of 2024 3748 39DC.tmp 104 PID 2024 wrote to memory of 4620 2024 3A4A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_674e5590750298981bd63d83ed79b531_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\32D7.tmp"C:\Users\Admin\AppData\Local\Temp\32D7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"23⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"24⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"25⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"26⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"27⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"28⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"29⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"30⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"31⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"32⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"33⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"34⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"35⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"36⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"37⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"38⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"39⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"40⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"41⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"42⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"44⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"45⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"46⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"47⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"48⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"49⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"50⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"51⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"52⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"53⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"54⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"55⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"56⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"57⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"58⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"59⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"60⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"61⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"62⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"63⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"64⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"65⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"66⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"67⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"68⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"69⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"70⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"71⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"72⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"73⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"74⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"75⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"76⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"77⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"78⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"79⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"80⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"81⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"83⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"84⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"85⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"86⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"87⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"88⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"89⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"90⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"91⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"92⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"94⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"95⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"96⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"97⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"98⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"99⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"100⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"101⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"102⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"103⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"104⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"105⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"106⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"107⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"108⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"109⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"110⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"111⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"112⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"113⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"114⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"115⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"116⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"117⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"118⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"119⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"120⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"121⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"122⤵PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-