Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe
-
Size
520KB
-
MD5
f3cfc18b85c287f5d0ad58c6d6aa367a
-
SHA1
e38381ae0e5b7956018206924e8b35228e19d331
-
SHA256
800db1cd07fa974261e66ebcbc314d5f9ad726e94e7cd41cf873928687f3a242
-
SHA512
d0208af951a478b7133717c9822b5d5159da0fffd1d5920e95122a7ade25edb266eb1b3249ca8237ead821bfa46dbfa044d377b931bf53671dbc88156d6438ac
-
SSDEEP
12288:roRXOQjmOyj2pAyu97HM47cHUJ64aGs03zNqQNZ:rogQ9y2A/HNw9GsSN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4512 322C.tmp 3312 32A9.tmp 2812 3326.tmp 4716 33C2.tmp 3560 345E.tmp 628 34CB.tmp 3180 3539.tmp 4864 3597.tmp 2296 35F4.tmp 3452 3642.tmp 3616 36B0.tmp 448 36FE.tmp 3436 375C.tmp 1500 37B9.tmp 4372 3827.tmp 388 3875.tmp 4080 38E2.tmp 4932 395F.tmp 4152 39DC.tmp 3884 3A4A.tmp 3680 3AB7.tmp 2760 3B24.tmp 3948 3B82.tmp 3320 3BE0.tmp 1072 3C4D.tmp 3164 3C9B.tmp 3408 3D09.tmp 4204 3D57.tmp 4136 3DB5.tmp 4216 3E03.tmp 2624 3E80.tmp 1680 3EDE.tmp 4516 3F5B.tmp 1912 3FA9.tmp 2216 4006.tmp 2196 4055.tmp 4520 40C2.tmp 1620 4110.tmp 3032 415E.tmp 3808 41AC.tmp 4092 41FA.tmp 2016 4249.tmp 2720 42A6.tmp 224 4304.tmp 3456 4352.tmp 4464 43A0.tmp 688 43EE.tmp 1364 443D.tmp 4408 449A.tmp 3564 44F8.tmp 4192 4556.tmp 4564 45A4.tmp 976 4602.tmp 4024 4650.tmp 3960 46AE.tmp 3496 470B.tmp 4104 4769.tmp 1388 47C7.tmp 2156 4825.tmp 3692 4873.tmp 2572 48D0.tmp 2688 492E.tmp 5100 497C.tmp 5080 49CA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4512 3632 2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe 82 PID 3632 wrote to memory of 4512 3632 2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe 82 PID 3632 wrote to memory of 4512 3632 2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe 82 PID 4512 wrote to memory of 3312 4512 322C.tmp 84 PID 4512 wrote to memory of 3312 4512 322C.tmp 84 PID 4512 wrote to memory of 3312 4512 322C.tmp 84 PID 3312 wrote to memory of 2812 3312 32A9.tmp 86 PID 3312 wrote to memory of 2812 3312 32A9.tmp 86 PID 3312 wrote to memory of 2812 3312 32A9.tmp 86 PID 2812 wrote to memory of 4716 2812 3326.tmp 87 PID 2812 wrote to memory of 4716 2812 3326.tmp 87 PID 2812 wrote to memory of 4716 2812 3326.tmp 87 PID 4716 wrote to memory of 3560 4716 33C2.tmp 89 PID 4716 wrote to memory of 3560 4716 33C2.tmp 89 PID 4716 wrote to memory of 3560 4716 33C2.tmp 89 PID 3560 wrote to memory of 628 3560 345E.tmp 90 PID 3560 wrote to memory of 628 3560 345E.tmp 90 PID 3560 wrote to memory of 628 3560 345E.tmp 90 PID 628 wrote to memory of 3180 628 34CB.tmp 91 PID 628 wrote to memory of 3180 628 34CB.tmp 91 PID 628 wrote to memory of 3180 628 34CB.tmp 91 PID 3180 wrote to memory of 4864 3180 3539.tmp 92 PID 3180 wrote to memory of 4864 3180 3539.tmp 92 PID 3180 wrote to memory of 4864 3180 3539.tmp 92 PID 4864 wrote to memory of 2296 4864 3597.tmp 93 PID 4864 wrote to memory of 2296 4864 3597.tmp 93 PID 4864 wrote to memory of 2296 4864 3597.tmp 93 PID 2296 wrote to memory of 3452 2296 35F4.tmp 94 PID 2296 wrote to memory of 3452 2296 35F4.tmp 94 PID 2296 wrote to memory of 3452 2296 35F4.tmp 94 PID 3452 wrote to memory of 3616 3452 3642.tmp 95 PID 3452 wrote to memory of 3616 3452 3642.tmp 95 PID 3452 wrote to memory of 3616 3452 3642.tmp 95 PID 3616 wrote to memory of 448 3616 36B0.tmp 96 PID 3616 wrote to memory of 448 3616 36B0.tmp 96 PID 3616 wrote to memory of 448 3616 36B0.tmp 96 PID 448 wrote to memory of 3436 448 36FE.tmp 97 PID 448 wrote to memory of 3436 448 36FE.tmp 97 PID 448 wrote to memory of 3436 448 36FE.tmp 97 PID 3436 wrote to memory of 1500 3436 375C.tmp 98 PID 3436 wrote to memory of 1500 3436 375C.tmp 98 PID 3436 wrote to memory of 1500 3436 375C.tmp 98 PID 1500 wrote to memory of 4372 1500 37B9.tmp 99 PID 1500 wrote to memory of 4372 1500 37B9.tmp 99 PID 1500 wrote to memory of 4372 1500 37B9.tmp 99 PID 4372 wrote to memory of 388 4372 3827.tmp 100 PID 4372 wrote to memory of 388 4372 3827.tmp 100 PID 4372 wrote to memory of 388 4372 3827.tmp 100 PID 388 wrote to memory of 4080 388 3875.tmp 101 PID 388 wrote to memory of 4080 388 3875.tmp 101 PID 388 wrote to memory of 4080 388 3875.tmp 101 PID 4080 wrote to memory of 4932 4080 38E2.tmp 102 PID 4080 wrote to memory of 4932 4080 38E2.tmp 102 PID 4080 wrote to memory of 4932 4080 38E2.tmp 102 PID 4932 wrote to memory of 4152 4932 395F.tmp 103 PID 4932 wrote to memory of 4152 4932 395F.tmp 103 PID 4932 wrote to memory of 4152 4932 395F.tmp 103 PID 4152 wrote to memory of 3884 4152 39DC.tmp 104 PID 4152 wrote to memory of 3884 4152 39DC.tmp 104 PID 4152 wrote to memory of 3884 4152 39DC.tmp 104 PID 3884 wrote to memory of 3680 3884 3A4A.tmp 105 PID 3884 wrote to memory of 3680 3884 3A4A.tmp 105 PID 3884 wrote to memory of 3680 3884 3A4A.tmp 105 PID 3680 wrote to memory of 2760 3680 3AB7.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f3cfc18b85c287f5d0ad58c6d6aa367a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\322C.tmp"C:\Users\Admin\AppData\Local\Temp\322C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"23⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"24⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"25⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"26⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"27⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"28⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"29⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"30⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"31⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"32⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"33⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"34⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"35⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"36⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"37⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"38⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"39⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"40⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"41⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"42⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"43⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"44⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"45⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"46⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"47⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"48⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"49⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"50⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"51⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"52⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"53⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"54⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"55⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"56⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"57⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"58⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"59⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"60⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"61⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"62⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"63⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"64⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"65⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"66⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"67⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"69⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"70⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"71⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"72⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"73⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"74⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"75⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"77⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"78⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"79⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"80⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"81⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"82⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"83⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"84⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"85⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"86⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"87⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"88⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"89⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"90⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"91⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"92⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"93⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"94⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"95⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"96⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"97⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"98⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"100⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"101⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"102⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"103⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"104⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"105⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"106⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"107⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"108⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"109⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"110⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"111⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"112⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"113⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"114⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"115⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"116⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"117⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"118⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"119⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"120⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"121⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"122⤵PID:900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-