Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
-
Size
536KB
-
MD5
5d30268c2643e1162b11c5d6d4941018
-
SHA1
dc49e24ad9e3bf8ea260f86cadd1335d977e9694
-
SHA256
8c2a09a90d6563f607a25a7d543d61e82758dfd040237c4659da3bb723cfbcd3
-
SHA512
7dca9045b14d9c035c0eeb00fbc994d68da00bd5aef40b4a32cfde8fff5a13a5c7b1d65e1c55d19978dafcb20fa1b2a41f5047a943a221b712ecf5d47181fa17
-
SSDEEP
12288:wU5rCOTeiUww5CX7Wy13r45gOwrEjeYIZxVJ0ZT9:wUQOJU/9yF0iO7jHIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1700 EF80.tmp 1780 F0C8.tmp 1192 F220.tmp 3996 F31A.tmp 4880 F433.tmp 3232 FA4E.tmp 3356 FC90.tmp 4308 FDC9.tmp 2084 FF20.tmp 2660 59.tmp 644 182.tmp 2028 29B.tmp 708 3A5.tmp 656 4DD.tmp 2388 5A8.tmp 1900 6B2.tmp 2144 80A.tmp 4756 904.tmp 4108 9DE.tmp 3656 AC9.tmp 976 BE2.tmp 3740 D0B.tmp 4560 DF5.tmp 4984 1085.tmp 4252 11BE.tmp 4064 12F6.tmp 564 145E.tmp 2712 1577.tmp 3300 16B0.tmp 4360 17B9.tmp 1360 18D2.tmp 4652 19BD.tmp 1432 1AB7.tmp 440 1BEF.tmp 5032 1CDA.tmp 1184 1D86.tmp 4744 1E80.tmp 2072 1F4B.tmp 1252 1FF7.tmp 1656 20F1.tmp 2112 21FA.tmp 2540 22C5.tmp 748 2390.tmp 2460 243C.tmp 4988 24F8.tmp 1988 25C3.tmp 1376 267E.tmp 2024 2853.tmp 1892 28D0.tmp 816 299B.tmp 4684 2A18.tmp 3656 2B12.tmp 4396 2B8F.tmp 1232 2BFD.tmp 4620 2C6A.tmp 4884 2D54.tmp 1040 2DC2.tmp 2788 2E3F.tmp 2464 2F29.tmp 4760 2FD5.tmp 2712 3091.tmp 1068 30FE.tmp 1916 318B.tmp 456 31E8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 1700 1804 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 90 PID 1804 wrote to memory of 1700 1804 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 90 PID 1804 wrote to memory of 1700 1804 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 90 PID 1700 wrote to memory of 1780 1700 EF80.tmp 91 PID 1700 wrote to memory of 1780 1700 EF80.tmp 91 PID 1700 wrote to memory of 1780 1700 EF80.tmp 91 PID 1780 wrote to memory of 1192 1780 F0C8.tmp 92 PID 1780 wrote to memory of 1192 1780 F0C8.tmp 92 PID 1780 wrote to memory of 1192 1780 F0C8.tmp 92 PID 1192 wrote to memory of 3996 1192 F220.tmp 93 PID 1192 wrote to memory of 3996 1192 F220.tmp 93 PID 1192 wrote to memory of 3996 1192 F220.tmp 93 PID 3996 wrote to memory of 4880 3996 F31A.tmp 94 PID 3996 wrote to memory of 4880 3996 F31A.tmp 94 PID 3996 wrote to memory of 4880 3996 F31A.tmp 94 PID 4880 wrote to memory of 3232 4880 F433.tmp 95 PID 4880 wrote to memory of 3232 4880 F433.tmp 95 PID 4880 wrote to memory of 3232 4880 F433.tmp 95 PID 3232 wrote to memory of 3356 3232 FA4E.tmp 96 PID 3232 wrote to memory of 3356 3232 FA4E.tmp 96 PID 3232 wrote to memory of 3356 3232 FA4E.tmp 96 PID 3356 wrote to memory of 4308 3356 FC90.tmp 97 PID 3356 wrote to memory of 4308 3356 FC90.tmp 97 PID 3356 wrote to memory of 4308 3356 FC90.tmp 97 PID 4308 wrote to memory of 2084 4308 FDC9.tmp 98 PID 4308 wrote to memory of 2084 4308 FDC9.tmp 98 PID 4308 wrote to memory of 2084 4308 FDC9.tmp 98 PID 2084 wrote to memory of 2660 2084 FF20.tmp 99 PID 2084 wrote to memory of 2660 2084 FF20.tmp 99 PID 2084 wrote to memory of 2660 2084 FF20.tmp 99 PID 2660 wrote to memory of 644 2660 59.tmp 100 PID 2660 wrote to memory of 644 2660 59.tmp 100 PID 2660 wrote to memory of 644 2660 59.tmp 100 PID 644 wrote to memory of 2028 644 182.tmp 101 PID 644 wrote to memory of 2028 644 182.tmp 101 PID 644 wrote to memory of 2028 644 182.tmp 101 PID 2028 wrote to memory of 708 2028 29B.tmp 102 PID 2028 wrote to memory of 708 2028 29B.tmp 102 PID 2028 wrote to memory of 708 2028 29B.tmp 102 PID 708 wrote to memory of 656 708 3A5.tmp 103 PID 708 wrote to memory of 656 708 3A5.tmp 103 PID 708 wrote to memory of 656 708 3A5.tmp 103 PID 656 wrote to memory of 2388 656 4DD.tmp 104 PID 656 wrote to memory of 2388 656 4DD.tmp 104 PID 656 wrote to memory of 2388 656 4DD.tmp 104 PID 2388 wrote to memory of 1900 2388 5A8.tmp 105 PID 2388 wrote to memory of 1900 2388 5A8.tmp 105 PID 2388 wrote to memory of 1900 2388 5A8.tmp 105 PID 1900 wrote to memory of 2144 1900 6B2.tmp 106 PID 1900 wrote to memory of 2144 1900 6B2.tmp 106 PID 1900 wrote to memory of 2144 1900 6B2.tmp 106 PID 2144 wrote to memory of 4756 2144 80A.tmp 107 PID 2144 wrote to memory of 4756 2144 80A.tmp 107 PID 2144 wrote to memory of 4756 2144 80A.tmp 107 PID 4756 wrote to memory of 4108 4756 904.tmp 108 PID 4756 wrote to memory of 4108 4756 904.tmp 108 PID 4756 wrote to memory of 4108 4756 904.tmp 108 PID 4108 wrote to memory of 3656 4108 9DE.tmp 109 PID 4108 wrote to memory of 3656 4108 9DE.tmp 109 PID 4108 wrote to memory of 3656 4108 9DE.tmp 109 PID 3656 wrote to memory of 976 3656 AC9.tmp 110 PID 3656 wrote to memory of 976 3656 AC9.tmp 110 PID 3656 wrote to memory of 976 3656 AC9.tmp 110 PID 976 wrote to memory of 3740 976 BE2.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"23⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"24⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"25⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"26⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"27⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"28⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"29⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"30⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"31⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"32⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"33⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"34⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"35⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"36⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"37⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"38⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"39⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"40⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"41⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"42⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"43⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"44⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"45⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"46⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"47⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"48⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"49⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"50⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"51⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"52⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"53⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"54⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"55⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"56⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"57⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"58⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"59⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"60⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"61⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"62⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"63⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"64⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"65⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"66⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"67⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"68⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"69⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"70⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"71⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"72⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"73⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"74⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"75⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"76⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"77⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"78⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"79⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"80⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"81⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"82⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"83⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"84⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"85⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"86⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"87⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"88⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"89⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"90⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"91⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"92⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"93⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"94⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"95⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\4570.tmp"C:\Users\Admin\AppData\Local\Temp\4570.tmp"96⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"97⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"98⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"99⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"100⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"101⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"102⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"103⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"104⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"105⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"106⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"107⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"108⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"109⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"110⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"111⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"112⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"113⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"114⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"115⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"116⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"117⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"118⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"119⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"120⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"121⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-