Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe
-
Size
486KB
-
MD5
cb8ae7c1fd9806acb4f92e85d42e5e80
-
SHA1
a8830bb4456d1e4fd348a4fa17e8fde63b819cb2
-
SHA256
e5f40ff1c519977d57103a9b9b971b9678b1cafa6796f27e39969bb00ff4e842
-
SHA512
20f2de3698db2a532d33ac76cf4b636eb7d787d8fad2a50bbc362991084480d990bcb003227b5bf9361aae160d2c41e5d648e9d705ade0c2df4e9a9d32a145b6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7mQRg19FSiu5U2qHfZYrs6tER08MpyGaSUwJG:/U5rCOTeiDWjUiczqhInEO8iBU77/NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4924 3E80.tmp 4000 3EED.tmp 452 3F5B.tmp 4796 3FB8.tmp 3464 4016.tmp 768 4074.tmp 1940 40E1.tmp 636 413F.tmp 3380 419D.tmp 2368 41FA.tmp 2240 4258.tmp 764 42B6.tmp 2036 4314.tmp 4688 4371.tmp 2056 43EE.tmp 616 446B.tmp 3840 44C9.tmp 3884 4517.tmp 4084 4585.tmp 3148 45D3.tmp 1504 4631.tmp 384 469E.tmp 2464 470B.tmp 3972 4779.tmp 1032 47C7.tmp 4504 4825.tmp 2532 4873.tmp 3196 48D0.tmp 676 493E.tmp 456 49AB.tmp 4396 49F9.tmp 3480 4A76.tmp 916 4AE4.tmp 4612 4B32.tmp 2544 4B90.tmp 540 4BDE.tmp 4928 4C3B.tmp 3360 4C99.tmp 3504 4CE7.tmp 4264 4D35.tmp 1340 4D84.tmp 3424 4DD2.tmp 4672 4E20.tmp 2132 4E6E.tmp 1404 4EBC.tmp 5104 4F0A.tmp 2364 4F58.tmp 3616 4FA6.tmp 1684 4FF5.tmp 4452 5052.tmp 1776 50A0.tmp 3660 50FE.tmp 2632 514C.tmp 1300 51AA.tmp 1428 51F8.tmp 1332 5256.tmp 452 52A4.tmp 2052 52F2.tmp 5076 5350.tmp 2092 539E.tmp 4400 53FC.tmp 3624 545A.tmp 552 54A8.tmp 4840 5505.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3888 wrote to memory of 4924 3888 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 84 PID 3888 wrote to memory of 4924 3888 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 84 PID 3888 wrote to memory of 4924 3888 2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe 84 PID 4924 wrote to memory of 4000 4924 3E80.tmp 85 PID 4924 wrote to memory of 4000 4924 3E80.tmp 85 PID 4924 wrote to memory of 4000 4924 3E80.tmp 85 PID 4000 wrote to memory of 452 4000 3EED.tmp 86 PID 4000 wrote to memory of 452 4000 3EED.tmp 86 PID 4000 wrote to memory of 452 4000 3EED.tmp 86 PID 452 wrote to memory of 4796 452 3F5B.tmp 87 PID 452 wrote to memory of 4796 452 3F5B.tmp 87 PID 452 wrote to memory of 4796 452 3F5B.tmp 87 PID 4796 wrote to memory of 3464 4796 3FB8.tmp 88 PID 4796 wrote to memory of 3464 4796 3FB8.tmp 88 PID 4796 wrote to memory of 3464 4796 3FB8.tmp 88 PID 3464 wrote to memory of 768 3464 4016.tmp 89 PID 3464 wrote to memory of 768 3464 4016.tmp 89 PID 3464 wrote to memory of 768 3464 4016.tmp 89 PID 768 wrote to memory of 1940 768 4074.tmp 90 PID 768 wrote to memory of 1940 768 4074.tmp 90 PID 768 wrote to memory of 1940 768 4074.tmp 90 PID 1940 wrote to memory of 636 1940 40E1.tmp 91 PID 1940 wrote to memory of 636 1940 40E1.tmp 91 PID 1940 wrote to memory of 636 1940 40E1.tmp 91 PID 636 wrote to memory of 3380 636 413F.tmp 92 PID 636 wrote to memory of 3380 636 413F.tmp 92 PID 636 wrote to memory of 3380 636 413F.tmp 92 PID 3380 wrote to memory of 2368 3380 419D.tmp 93 PID 3380 wrote to memory of 2368 3380 419D.tmp 93 PID 3380 wrote to memory of 2368 3380 419D.tmp 93 PID 2368 wrote to memory of 2240 2368 41FA.tmp 94 PID 2368 wrote to memory of 2240 2368 41FA.tmp 94 PID 2368 wrote to memory of 2240 2368 41FA.tmp 94 PID 2240 wrote to memory of 764 2240 4258.tmp 95 PID 2240 wrote to memory of 764 2240 4258.tmp 95 PID 2240 wrote to memory of 764 2240 4258.tmp 95 PID 764 wrote to memory of 2036 764 42B6.tmp 96 PID 764 wrote to memory of 2036 764 42B6.tmp 96 PID 764 wrote to memory of 2036 764 42B6.tmp 96 PID 2036 wrote to memory of 4688 2036 4314.tmp 97 PID 2036 wrote to memory of 4688 2036 4314.tmp 97 PID 2036 wrote to memory of 4688 2036 4314.tmp 97 PID 4688 wrote to memory of 2056 4688 4371.tmp 98 PID 4688 wrote to memory of 2056 4688 4371.tmp 98 PID 4688 wrote to memory of 2056 4688 4371.tmp 98 PID 2056 wrote to memory of 616 2056 43EE.tmp 99 PID 2056 wrote to memory of 616 2056 43EE.tmp 99 PID 2056 wrote to memory of 616 2056 43EE.tmp 99 PID 616 wrote to memory of 3840 616 446B.tmp 100 PID 616 wrote to memory of 3840 616 446B.tmp 100 PID 616 wrote to memory of 3840 616 446B.tmp 100 PID 3840 wrote to memory of 3884 3840 44C9.tmp 101 PID 3840 wrote to memory of 3884 3840 44C9.tmp 101 PID 3840 wrote to memory of 3884 3840 44C9.tmp 101 PID 3884 wrote to memory of 4084 3884 4517.tmp 102 PID 3884 wrote to memory of 4084 3884 4517.tmp 102 PID 3884 wrote to memory of 4084 3884 4517.tmp 102 PID 4084 wrote to memory of 3148 4084 4585.tmp 103 PID 4084 wrote to memory of 3148 4084 4585.tmp 103 PID 4084 wrote to memory of 3148 4084 4585.tmp 103 PID 3148 wrote to memory of 1504 3148 45D3.tmp 104 PID 3148 wrote to memory of 1504 3148 45D3.tmp 104 PID 3148 wrote to memory of 1504 3148 45D3.tmp 104 PID 1504 wrote to memory of 384 1504 4631.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_cb8ae7c1fd9806acb4f92e85d42e5e80_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"23⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"24⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"25⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"26⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"27⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"28⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"29⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"30⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"31⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"32⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"33⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"34⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"35⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"36⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"37⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"38⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"39⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"40⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"41⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"42⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"43⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"44⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"45⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"46⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"47⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"48⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"49⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"50⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"51⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"52⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"53⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"54⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"55⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"56⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"57⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"58⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"59⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"60⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"61⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"62⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"63⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"64⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"65⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"66⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"67⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"68⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"69⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"70⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"71⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"72⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"73⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"74⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"75⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"77⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"78⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"79⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"80⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"81⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"82⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"83⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"84⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"85⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"86⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"88⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"89⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"90⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"91⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"92⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"93⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"94⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"95⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"96⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"97⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"98⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"99⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"100⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"101⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"102⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"103⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"104⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"105⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"106⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"107⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"108⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"109⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"110⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"111⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"112⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"113⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"114⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"115⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"116⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"117⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"118⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"119⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"120⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"121⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"122⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-