Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe
-
Size
527KB
-
MD5
9507d41c00e6f8ad6b9b02c41a7b5a07
-
SHA1
3d81d1594ae69de284e15f4788598a8ec4dfb5e3
-
SHA256
546e654d133e4b81460236e30483b8410a4581751219647529bd62c59fa838da
-
SHA512
72026f5dca3a63a1093c960dffb0f7673280b396b33f4a5b70f796a0bcfcc8fa5d42db71fabec542f750499386a4995ad3f2d6e7dd619381153823d2bf740f9c
-
SSDEEP
12288:fU5rCOTeidWFVb+Avdkw5Pc+DmdghQDZu:fUQOJdtAxP5RQDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4536 1E60.tmp 3960 2110.tmp 1316 220A.tmp 1828 2323.tmp 3908 248A.tmp 4684 2556.tmp 384 2630.tmp 4984 26EC.tmp 2492 2798.tmp 1368 2853.tmp 3744 296C.tmp 3444 2A57.tmp 4316 2B22.tmp 3312 2BDD.tmp 3344 2CE7.tmp 3736 2D83.tmp 1232 2E4E.tmp 2236 2F29.tmp 2100 3052.tmp 5032 312D.tmp 3440 3275.tmp 3836 337F.tmp 3976 34D6.tmp 116 35D0.tmp 2052 36AB.tmp 1308 37D4.tmp 904 3880.tmp 1852 3989.tmp 4504 3A55.tmp 2140 3AE1.tmp 3544 3CB6.tmp 4016 3D91.tmp 648 3E3D.tmp 4544 3EE8.tmp 2464 3F65.tmp 1392 3FE2.tmp 1856 407F.tmp 4380 410B.tmp 3916 41B7.tmp 4596 4234.tmp 2240 42B1.tmp 2412 43DA.tmp 1984 4457.tmp 3272 44E4.tmp 860 4561.tmp 1136 464B.tmp 2068 46D8.tmp 4672 47A3.tmp 4536 483F.tmp 832 490A.tmp 2264 49A6.tmp 1592 4A33.tmp 1652 4ACF.tmp 4428 4B9A.tmp 4392 4C17.tmp 2676 4CF2.tmp 4724 4D60.tmp 836 4DDD.tmp 3536 4EE6.tmp 1384 4FE0.tmp 688 50BB.tmp 1156 5128.tmp 3356 5196.tmp 488 5222.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 4536 3068 2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe 88 PID 3068 wrote to memory of 4536 3068 2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe 88 PID 3068 wrote to memory of 4536 3068 2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe 88 PID 4536 wrote to memory of 3960 4536 1E60.tmp 89 PID 4536 wrote to memory of 3960 4536 1E60.tmp 89 PID 4536 wrote to memory of 3960 4536 1E60.tmp 89 PID 3960 wrote to memory of 1316 3960 2110.tmp 90 PID 3960 wrote to memory of 1316 3960 2110.tmp 90 PID 3960 wrote to memory of 1316 3960 2110.tmp 90 PID 1316 wrote to memory of 1828 1316 220A.tmp 91 PID 1316 wrote to memory of 1828 1316 220A.tmp 91 PID 1316 wrote to memory of 1828 1316 220A.tmp 91 PID 1828 wrote to memory of 3908 1828 2323.tmp 92 PID 1828 wrote to memory of 3908 1828 2323.tmp 92 PID 1828 wrote to memory of 3908 1828 2323.tmp 92 PID 3908 wrote to memory of 4684 3908 248A.tmp 93 PID 3908 wrote to memory of 4684 3908 248A.tmp 93 PID 3908 wrote to memory of 4684 3908 248A.tmp 93 PID 4684 wrote to memory of 384 4684 2556.tmp 94 PID 4684 wrote to memory of 384 4684 2556.tmp 94 PID 4684 wrote to memory of 384 4684 2556.tmp 94 PID 384 wrote to memory of 4984 384 2630.tmp 95 PID 384 wrote to memory of 4984 384 2630.tmp 95 PID 384 wrote to memory of 4984 384 2630.tmp 95 PID 4984 wrote to memory of 2492 4984 26EC.tmp 96 PID 4984 wrote to memory of 2492 4984 26EC.tmp 96 PID 4984 wrote to memory of 2492 4984 26EC.tmp 96 PID 2492 wrote to memory of 1368 2492 2798.tmp 97 PID 2492 wrote to memory of 1368 2492 2798.tmp 97 PID 2492 wrote to memory of 1368 2492 2798.tmp 97 PID 1368 wrote to memory of 3744 1368 2853.tmp 98 PID 1368 wrote to memory of 3744 1368 2853.tmp 98 PID 1368 wrote to memory of 3744 1368 2853.tmp 98 PID 3744 wrote to memory of 3444 3744 296C.tmp 99 PID 3744 wrote to memory of 3444 3744 296C.tmp 99 PID 3744 wrote to memory of 3444 3744 296C.tmp 99 PID 3444 wrote to memory of 4316 3444 2A57.tmp 100 PID 3444 wrote to memory of 4316 3444 2A57.tmp 100 PID 3444 wrote to memory of 4316 3444 2A57.tmp 100 PID 4316 wrote to memory of 3312 4316 2B22.tmp 101 PID 4316 wrote to memory of 3312 4316 2B22.tmp 101 PID 4316 wrote to memory of 3312 4316 2B22.tmp 101 PID 3312 wrote to memory of 3344 3312 2BDD.tmp 102 PID 3312 wrote to memory of 3344 3312 2BDD.tmp 102 PID 3312 wrote to memory of 3344 3312 2BDD.tmp 102 PID 3344 wrote to memory of 3736 3344 2CE7.tmp 103 PID 3344 wrote to memory of 3736 3344 2CE7.tmp 103 PID 3344 wrote to memory of 3736 3344 2CE7.tmp 103 PID 3736 wrote to memory of 1232 3736 2D83.tmp 104 PID 3736 wrote to memory of 1232 3736 2D83.tmp 104 PID 3736 wrote to memory of 1232 3736 2D83.tmp 104 PID 1232 wrote to memory of 2236 1232 2E4E.tmp 105 PID 1232 wrote to memory of 2236 1232 2E4E.tmp 105 PID 1232 wrote to memory of 2236 1232 2E4E.tmp 105 PID 2236 wrote to memory of 2100 2236 2F29.tmp 106 PID 2236 wrote to memory of 2100 2236 2F29.tmp 106 PID 2236 wrote to memory of 2100 2236 2F29.tmp 106 PID 2100 wrote to memory of 5032 2100 3052.tmp 107 PID 2100 wrote to memory of 5032 2100 3052.tmp 107 PID 2100 wrote to memory of 5032 2100 3052.tmp 107 PID 5032 wrote to memory of 3440 5032 312D.tmp 108 PID 5032 wrote to memory of 3440 5032 312D.tmp 108 PID 5032 wrote to memory of 3440 5032 312D.tmp 108 PID 3440 wrote to memory of 3836 3440 3275.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_9507d41c00e6f8ad6b9b02c41a7b5a07_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"23⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"24⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"25⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"26⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"27⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"28⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"29⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"30⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"31⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"32⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"33⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"34⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"35⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"36⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"37⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"38⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"39⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"40⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"41⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"42⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"43⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"44⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"45⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"46⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"47⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"48⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"49⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"50⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"51⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"52⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"53⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"54⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"55⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"56⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"57⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"58⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"59⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"60⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"61⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"62⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"63⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"64⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"65⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"66⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"67⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"68⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"69⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"71⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"72⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"73⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"74⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"75⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"76⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"77⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"78⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"79⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"80⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"81⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"82⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"83⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"84⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"85⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"86⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"87⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"89⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"90⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"91⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"92⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"93⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"94⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"95⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"98⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"99⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"100⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"101⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"102⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"103⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"104⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"105⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"106⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"107⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"108⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"109⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"110⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"111⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"112⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"113⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"114⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"115⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"118⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"119⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"120⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"121⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"122⤵PID:808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-