Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 11:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe
-
Size
488KB
-
MD5
7d1a77d6173c3bb4e39bb3d4763fb318
-
SHA1
02d87ad9ef3e633f1128a760f53d675107b80aed
-
SHA256
c27d6deeb71b03968527e366aa3edb1992002aaed8e64a3b47d51dc5ae134ff0
-
SHA512
3da2ac12224618b449ce8c8b9a7b1579feb04de6e792c26c04c41cabc6bbb160fc98b223f3e678fac810d1a5ab9ae0852fa2312edab29cfbe78036ef886291b2
-
SSDEEP
12288:/U5rCOTeiDuVfrdsWx9GvNYmdVM8POoNZ:/UQOJDubsWPGvKm1pN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 836 3B44.tmp 740 3BE0.tmp 4140 3C5D.tmp 4468 3D18.tmp 736 3DA5.tmp 4524 3E22.tmp 3580 3E80.tmp 3636 3EFD.tmp 1080 3F6A.tmp 5100 3FF7.tmp 3256 4055.tmp 3156 40E1.tmp 1384 413F.tmp 4744 419D.tmp 5004 421A.tmp 3500 42A6.tmp 1088 4333.tmp 2964 43B0.tmp 2088 443D.tmp 3832 44AA.tmp 2196 4517.tmp 3820 45A4.tmp 4376 4631.tmp 4828 468E.tmp 1616 470B.tmp 2916 4769.tmp 4780 47F6.tmp 1656 4882.tmp 4836 48E0.tmp 1268 494D.tmp 4188 49CA.tmp 1708 4A19.tmp 1628 4A96.tmp 4660 4AF3.tmp 4048 4B51.tmp 2132 4BAF.tmp 3036 4C0D.tmp 4324 4C5B.tmp 2632 4CB8.tmp 3628 4D07.tmp 920 4D55.tmp 4116 4DB2.tmp 2892 4E01.tmp 3096 4E5E.tmp 436 4EBC.tmp 4208 4F0A.tmp 4220 4F58.tmp 1416 4FB6.tmp 4408 5023.tmp 1524 5081.tmp 788 50CF.tmp 1904 512D.tmp 3276 517B.tmp 2880 51D9.tmp 3748 5237.tmp 4292 5294.tmp 4820 52F2.tmp 4060 5350.tmp 864 53AE.tmp 836 540B.tmp 4688 5469.tmp 684 54C7.tmp 4944 5525.tmp 4468 5582.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 836 2044 2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe 84 PID 2044 wrote to memory of 836 2044 2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe 84 PID 2044 wrote to memory of 836 2044 2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe 84 PID 836 wrote to memory of 740 836 3B44.tmp 85 PID 836 wrote to memory of 740 836 3B44.tmp 85 PID 836 wrote to memory of 740 836 3B44.tmp 85 PID 740 wrote to memory of 4140 740 3BE0.tmp 86 PID 740 wrote to memory of 4140 740 3BE0.tmp 86 PID 740 wrote to memory of 4140 740 3BE0.tmp 86 PID 4140 wrote to memory of 4468 4140 3C5D.tmp 87 PID 4140 wrote to memory of 4468 4140 3C5D.tmp 87 PID 4140 wrote to memory of 4468 4140 3C5D.tmp 87 PID 4468 wrote to memory of 736 4468 3D18.tmp 88 PID 4468 wrote to memory of 736 4468 3D18.tmp 88 PID 4468 wrote to memory of 736 4468 3D18.tmp 88 PID 736 wrote to memory of 4524 736 3DA5.tmp 89 PID 736 wrote to memory of 4524 736 3DA5.tmp 89 PID 736 wrote to memory of 4524 736 3DA5.tmp 89 PID 4524 wrote to memory of 3580 4524 3E22.tmp 90 PID 4524 wrote to memory of 3580 4524 3E22.tmp 90 PID 4524 wrote to memory of 3580 4524 3E22.tmp 90 PID 3580 wrote to memory of 3636 3580 3E80.tmp 91 PID 3580 wrote to memory of 3636 3580 3E80.tmp 91 PID 3580 wrote to memory of 3636 3580 3E80.tmp 91 PID 3636 wrote to memory of 1080 3636 3EFD.tmp 92 PID 3636 wrote to memory of 1080 3636 3EFD.tmp 92 PID 3636 wrote to memory of 1080 3636 3EFD.tmp 92 PID 1080 wrote to memory of 5100 1080 3F6A.tmp 93 PID 1080 wrote to memory of 5100 1080 3F6A.tmp 93 PID 1080 wrote to memory of 5100 1080 3F6A.tmp 93 PID 5100 wrote to memory of 3256 5100 3FF7.tmp 94 PID 5100 wrote to memory of 3256 5100 3FF7.tmp 94 PID 5100 wrote to memory of 3256 5100 3FF7.tmp 94 PID 3256 wrote to memory of 3156 3256 4055.tmp 95 PID 3256 wrote to memory of 3156 3256 4055.tmp 95 PID 3256 wrote to memory of 3156 3256 4055.tmp 95 PID 3156 wrote to memory of 1384 3156 40E1.tmp 96 PID 3156 wrote to memory of 1384 3156 40E1.tmp 96 PID 3156 wrote to memory of 1384 3156 40E1.tmp 96 PID 1384 wrote to memory of 4744 1384 413F.tmp 97 PID 1384 wrote to memory of 4744 1384 413F.tmp 97 PID 1384 wrote to memory of 4744 1384 413F.tmp 97 PID 4744 wrote to memory of 5004 4744 419D.tmp 98 PID 4744 wrote to memory of 5004 4744 419D.tmp 98 PID 4744 wrote to memory of 5004 4744 419D.tmp 98 PID 5004 wrote to memory of 3500 5004 421A.tmp 99 PID 5004 wrote to memory of 3500 5004 421A.tmp 99 PID 5004 wrote to memory of 3500 5004 421A.tmp 99 PID 3500 wrote to memory of 1088 3500 42A6.tmp 100 PID 3500 wrote to memory of 1088 3500 42A6.tmp 100 PID 3500 wrote to memory of 1088 3500 42A6.tmp 100 PID 1088 wrote to memory of 2964 1088 4333.tmp 101 PID 1088 wrote to memory of 2964 1088 4333.tmp 101 PID 1088 wrote to memory of 2964 1088 4333.tmp 101 PID 2964 wrote to memory of 2088 2964 43B0.tmp 102 PID 2964 wrote to memory of 2088 2964 43B0.tmp 102 PID 2964 wrote to memory of 2088 2964 43B0.tmp 102 PID 2088 wrote to memory of 3832 2088 443D.tmp 103 PID 2088 wrote to memory of 3832 2088 443D.tmp 103 PID 2088 wrote to memory of 3832 2088 443D.tmp 103 PID 3832 wrote to memory of 2196 3832 44AA.tmp 104 PID 3832 wrote to memory of 2196 3832 44AA.tmp 104 PID 3832 wrote to memory of 2196 3832 44AA.tmp 104 PID 2196 wrote to memory of 3820 2196 4517.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_7d1a77d6173c3bb4e39bb3d4763fb318_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"23⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"24⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"25⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"26⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"27⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"28⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"29⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"30⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"31⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"32⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"33⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"34⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"35⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"36⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"37⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"38⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"39⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"40⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"41⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"42⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"43⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"44⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"45⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"46⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"47⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"48⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"49⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"50⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"51⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"52⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"53⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"54⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"55⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"56⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"57⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"58⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"59⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"60⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"61⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"62⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"63⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"64⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"65⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"66⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"67⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"68⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"69⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"70⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"71⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"72⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"73⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"74⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"75⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"76⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"77⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"78⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"79⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"80⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"81⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"82⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"83⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"84⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"85⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"86⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"87⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"88⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"89⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"90⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"91⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"92⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"94⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"95⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"96⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"97⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"98⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"99⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"100⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"101⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"102⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"103⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"104⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"105⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"106⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"107⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"108⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"109⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"110⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"111⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"112⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"113⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"114⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"115⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"116⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"117⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"118⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"119⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"120⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"121⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-