Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2024 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe
-
Size
536KB
-
MD5
559a7c1a72f1108e86507ecdda2ad281
-
SHA1
78a1586d42386849de3e8a36d94a4af15e60e7e4
-
SHA256
f5d51c67888f6cc8692d9b009d60fbeca94b772da2caa1300a1a0a4a567fff37
-
SHA512
c269f7b943e464ab7b8b896dcca84af3f511f2815b047d9c4a3282e062d4cb4470ba93fefde517649bf31dc8114c058607466791122d31b6b88706662e1bb890
-
SSDEEP
12288:wU5rCOTeiUk6eycHbC4rRD3hyzBq8IIZxVJ0ZT9:wUQOJU/eZZrRDYBgIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3308 4537.tmp 1472 4631.tmp 4264 470B.tmp 4408 47E6.tmp 1436 4882.tmp 3444 495D.tmp 3824 4A09.tmp 4180 4B03.tmp 3260 4B90.tmp 3684 4C3B.tmp 3864 4D16.tmp 1456 4DC2.tmp 3324 4E7E.tmp 3968 4F29.tmp 3156 512D.tmp 3432 517B.tmp 1124 51C9.tmp 2780 52B4.tmp 1744 538E.tmp 5048 544A.tmp 4688 54E6.tmp 3060 55E0.tmp 756 569C.tmp 4836 5728.tmp 1384 57E4.tmp 3296 5880.tmp 4752 593C.tmp 3372 5A16.tmp 3068 5AE1.tmp 3436 5B8D.tmp 4948 5C39.tmp 4416 5D04.tmp 2948 5DC0.tmp 2548 5E2D.tmp 4856 5E7B.tmp 2212 5EC9.tmp 3524 5F18.tmp 4428 5F66.tmp 4664 6012.tmp 4240 607F.tmp 2284 60CD.tmp 4488 611B.tmp 860 6169.tmp 2060 61B7.tmp 1752 6206.tmp 3492 6254.tmp 3740 62A2.tmp 3384 6300.tmp 2204 634E.tmp 872 63CB.tmp 2448 6419.tmp 4504 6467.tmp 4064 64B5.tmp 5004 6503.tmp 1336 6571.tmp 3884 65BF.tmp 384 661C.tmp 1744 667A.tmp 4868 66C8.tmp 4688 6716.tmp 4560 6774.tmp 4464 67C2.tmp 3784 6810.tmp 4908 685F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 3308 5108 2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe 86 PID 5108 wrote to memory of 3308 5108 2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe 86 PID 5108 wrote to memory of 3308 5108 2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe 86 PID 3308 wrote to memory of 1472 3308 4537.tmp 87 PID 3308 wrote to memory of 1472 3308 4537.tmp 87 PID 3308 wrote to memory of 1472 3308 4537.tmp 87 PID 1472 wrote to memory of 4264 1472 4631.tmp 88 PID 1472 wrote to memory of 4264 1472 4631.tmp 88 PID 1472 wrote to memory of 4264 1472 4631.tmp 88 PID 4264 wrote to memory of 4408 4264 470B.tmp 89 PID 4264 wrote to memory of 4408 4264 470B.tmp 89 PID 4264 wrote to memory of 4408 4264 470B.tmp 89 PID 4408 wrote to memory of 1436 4408 47E6.tmp 90 PID 4408 wrote to memory of 1436 4408 47E6.tmp 90 PID 4408 wrote to memory of 1436 4408 47E6.tmp 90 PID 1436 wrote to memory of 3444 1436 4882.tmp 91 PID 1436 wrote to memory of 3444 1436 4882.tmp 91 PID 1436 wrote to memory of 3444 1436 4882.tmp 91 PID 3444 wrote to memory of 3824 3444 495D.tmp 92 PID 3444 wrote to memory of 3824 3444 495D.tmp 92 PID 3444 wrote to memory of 3824 3444 495D.tmp 92 PID 3824 wrote to memory of 4180 3824 4A09.tmp 93 PID 3824 wrote to memory of 4180 3824 4A09.tmp 93 PID 3824 wrote to memory of 4180 3824 4A09.tmp 93 PID 4180 wrote to memory of 3260 4180 4B03.tmp 94 PID 4180 wrote to memory of 3260 4180 4B03.tmp 94 PID 4180 wrote to memory of 3260 4180 4B03.tmp 94 PID 3260 wrote to memory of 3684 3260 4B90.tmp 95 PID 3260 wrote to memory of 3684 3260 4B90.tmp 95 PID 3260 wrote to memory of 3684 3260 4B90.tmp 95 PID 3684 wrote to memory of 3864 3684 4C3B.tmp 96 PID 3684 wrote to memory of 3864 3684 4C3B.tmp 96 PID 3684 wrote to memory of 3864 3684 4C3B.tmp 96 PID 3864 wrote to memory of 1456 3864 4D16.tmp 97 PID 3864 wrote to memory of 1456 3864 4D16.tmp 97 PID 3864 wrote to memory of 1456 3864 4D16.tmp 97 PID 1456 wrote to memory of 3324 1456 4DC2.tmp 98 PID 1456 wrote to memory of 3324 1456 4DC2.tmp 98 PID 1456 wrote to memory of 3324 1456 4DC2.tmp 98 PID 3324 wrote to memory of 3968 3324 4E7E.tmp 99 PID 3324 wrote to memory of 3968 3324 4E7E.tmp 99 PID 3324 wrote to memory of 3968 3324 4E7E.tmp 99 PID 3968 wrote to memory of 3156 3968 4F29.tmp 100 PID 3968 wrote to memory of 3156 3968 4F29.tmp 100 PID 3968 wrote to memory of 3156 3968 4F29.tmp 100 PID 3156 wrote to memory of 3432 3156 512D.tmp 101 PID 3156 wrote to memory of 3432 3156 512D.tmp 101 PID 3156 wrote to memory of 3432 3156 512D.tmp 101 PID 3432 wrote to memory of 1124 3432 517B.tmp 102 PID 3432 wrote to memory of 1124 3432 517B.tmp 102 PID 3432 wrote to memory of 1124 3432 517B.tmp 102 PID 1124 wrote to memory of 2780 1124 51C9.tmp 103 PID 1124 wrote to memory of 2780 1124 51C9.tmp 103 PID 1124 wrote to memory of 2780 1124 51C9.tmp 103 PID 2780 wrote to memory of 1744 2780 52B4.tmp 104 PID 2780 wrote to memory of 1744 2780 52B4.tmp 104 PID 2780 wrote to memory of 1744 2780 52B4.tmp 104 PID 1744 wrote to memory of 5048 1744 538E.tmp 105 PID 1744 wrote to memory of 5048 1744 538E.tmp 105 PID 1744 wrote to memory of 5048 1744 538E.tmp 105 PID 5048 wrote to memory of 4688 5048 544A.tmp 106 PID 5048 wrote to memory of 4688 5048 544A.tmp 106 PID 5048 wrote to memory of 4688 5048 544A.tmp 106 PID 4688 wrote to memory of 3060 4688 54E6.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_559a7c1a72f1108e86507ecdda2ad281_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"23⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"24⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"25⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"26⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"27⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"28⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"29⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"30⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"31⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"32⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"33⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"34⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"35⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"36⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"37⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"38⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"39⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"40⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"41⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"42⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"43⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"44⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"45⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"46⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"47⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"48⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"49⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"50⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"51⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"52⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"53⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"54⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"55⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"56⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"57⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"58⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"59⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"60⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"61⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"62⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"63⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"64⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"65⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"66⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"67⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"68⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"69⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"70⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"71⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"72⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"73⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"74⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"75⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"76⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"77⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"78⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"79⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"80⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"81⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"82⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"83⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"84⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"85⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"86⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"87⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"88⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"89⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"90⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"91⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"92⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"93⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"94⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"95⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"96⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"97⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"98⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"99⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"100⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"101⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"102⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"103⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"104⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"106⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"107⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"108⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"109⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"110⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"111⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"112⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"113⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"114⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"115⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"116⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"117⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"118⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"119⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"120⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"121⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-