Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe
-
Size
486KB
-
MD5
6822b0fa5f5d28558f08b26560b9e563
-
SHA1
77c375d4e7d595647d944ecbda7bf3f0730c7bad
-
SHA256
1020c41734c3dbf9e26218342ad662f263928b7c2a5ba74930ad9eecba3517ad
-
SHA512
3231d3f72d74afe5444f05882f034431f659d9a8ca806275d78e68d904a0dbf9e8d425f5b6381cebcafd89933f8ba171879046a30239b82304a2f07f88b6fe3a
-
SSDEEP
12288:UU5rCOTeiDbVcg0pYLUhnQ9dX/m95I+YUcGNZ:UUQOJDbqg0Sgt4vAdN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5248 321C.tmp 1528 3289.tmp 5708 3326.tmp 1496 33B2.tmp 4732 3420.tmp 3692 348D.tmp 4804 350A.tmp 4612 3568.tmp 2392 35D5.tmp 2112 3652.tmp 4644 36BF.tmp 5392 372D.tmp 5472 379A.tmp 4700 37F8.tmp 6128 3856.tmp 2404 38B3.tmp 2592 3921.tmp 1932 396F.tmp 4456 39DC.tmp 4100 3A4A.tmp 652 3A98.tmp 3248 3B05.tmp 3392 3B73.tmp 5144 3BC1.tmp 4888 3C2E.tmp 2640 3C9B.tmp 4632 3D09.tmp 2800 3D95.tmp 4104 3E03.tmp 1000 3E70.tmp 3904 3EBE.tmp 4076 3F2C.tmp 4852 3FA9.tmp 4016 3FF7.tmp 2436 4055.tmp 5064 40B2.tmp 4512 4100.tmp 2116 414F.tmp 5556 41AC.tmp 1372 420A.tmp 2568 4268.tmp 2060 42C6.tmp 5136 4323.tmp 4288 4381.tmp 5332 43DF.tmp 2668 443D.tmp 1568 449A.tmp 5700 44E8.tmp 1444 4546.tmp 2348 4594.tmp 3140 45F2.tmp 2784 4640.tmp 5772 469E.tmp 5416 46EC.tmp 2880 474A.tmp 5672 47A8.tmp 5832 4805.tmp 5296 4863.tmp 808 48C1.tmp 5752 491F.tmp 1060 497C.tmp 3948 49CA.tmp 3652 4A28.tmp 1036 4A76.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 5248 4624 2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe 88 PID 4624 wrote to memory of 5248 4624 2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe 88 PID 4624 wrote to memory of 5248 4624 2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe 88 PID 5248 wrote to memory of 1528 5248 321C.tmp 89 PID 5248 wrote to memory of 1528 5248 321C.tmp 89 PID 5248 wrote to memory of 1528 5248 321C.tmp 89 PID 1528 wrote to memory of 5708 1528 3289.tmp 90 PID 1528 wrote to memory of 5708 1528 3289.tmp 90 PID 1528 wrote to memory of 5708 1528 3289.tmp 90 PID 5708 wrote to memory of 1496 5708 3326.tmp 92 PID 5708 wrote to memory of 1496 5708 3326.tmp 92 PID 5708 wrote to memory of 1496 5708 3326.tmp 92 PID 1496 wrote to memory of 4732 1496 33B2.tmp 93 PID 1496 wrote to memory of 4732 1496 33B2.tmp 93 PID 1496 wrote to memory of 4732 1496 33B2.tmp 93 PID 4732 wrote to memory of 3692 4732 3420.tmp 95 PID 4732 wrote to memory of 3692 4732 3420.tmp 95 PID 4732 wrote to memory of 3692 4732 3420.tmp 95 PID 3692 wrote to memory of 4804 3692 348D.tmp 97 PID 3692 wrote to memory of 4804 3692 348D.tmp 97 PID 3692 wrote to memory of 4804 3692 348D.tmp 97 PID 4804 wrote to memory of 4612 4804 350A.tmp 98 PID 4804 wrote to memory of 4612 4804 350A.tmp 98 PID 4804 wrote to memory of 4612 4804 350A.tmp 98 PID 4612 wrote to memory of 2392 4612 3568.tmp 100 PID 4612 wrote to memory of 2392 4612 3568.tmp 100 PID 4612 wrote to memory of 2392 4612 3568.tmp 100 PID 2392 wrote to memory of 2112 2392 35D5.tmp 101 PID 2392 wrote to memory of 2112 2392 35D5.tmp 101 PID 2392 wrote to memory of 2112 2392 35D5.tmp 101 PID 2112 wrote to memory of 4644 2112 3652.tmp 102 PID 2112 wrote to memory of 4644 2112 3652.tmp 102 PID 2112 wrote to memory of 4644 2112 3652.tmp 102 PID 4644 wrote to memory of 5392 4644 36BF.tmp 103 PID 4644 wrote to memory of 5392 4644 36BF.tmp 103 PID 4644 wrote to memory of 5392 4644 36BF.tmp 103 PID 5392 wrote to memory of 5472 5392 372D.tmp 104 PID 5392 wrote to memory of 5472 5392 372D.tmp 104 PID 5392 wrote to memory of 5472 5392 372D.tmp 104 PID 5472 wrote to memory of 4700 5472 379A.tmp 105 PID 5472 wrote to memory of 4700 5472 379A.tmp 105 PID 5472 wrote to memory of 4700 5472 379A.tmp 105 PID 4700 wrote to memory of 6128 4700 37F8.tmp 106 PID 4700 wrote to memory of 6128 4700 37F8.tmp 106 PID 4700 wrote to memory of 6128 4700 37F8.tmp 106 PID 6128 wrote to memory of 2404 6128 3856.tmp 107 PID 6128 wrote to memory of 2404 6128 3856.tmp 107 PID 6128 wrote to memory of 2404 6128 3856.tmp 107 PID 2404 wrote to memory of 2592 2404 38B3.tmp 108 PID 2404 wrote to memory of 2592 2404 38B3.tmp 108 PID 2404 wrote to memory of 2592 2404 38B3.tmp 108 PID 2592 wrote to memory of 1932 2592 3921.tmp 109 PID 2592 wrote to memory of 1932 2592 3921.tmp 109 PID 2592 wrote to memory of 1932 2592 3921.tmp 109 PID 1932 wrote to memory of 4456 1932 396F.tmp 110 PID 1932 wrote to memory of 4456 1932 396F.tmp 110 PID 1932 wrote to memory of 4456 1932 396F.tmp 110 PID 4456 wrote to memory of 4100 4456 39DC.tmp 111 PID 4456 wrote to memory of 4100 4456 39DC.tmp 111 PID 4456 wrote to memory of 4100 4456 39DC.tmp 111 PID 4100 wrote to memory of 652 4100 3A4A.tmp 112 PID 4100 wrote to memory of 652 4100 3A4A.tmp 112 PID 4100 wrote to memory of 652 4100 3A4A.tmp 112 PID 652 wrote to memory of 3248 652 3A98.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_6822b0fa5f5d28558f08b26560b9e563_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"23⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"24⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"25⤵
- Executes dropped EXE
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"26⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"27⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"28⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"29⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"30⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"31⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"32⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"33⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"34⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"35⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"36⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"37⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"38⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"39⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"40⤵
- Executes dropped EXE
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"41⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"42⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"43⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"44⤵
- Executes dropped EXE
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"45⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"46⤵
- Executes dropped EXE
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"47⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"48⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"49⤵
- Executes dropped EXE
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"50⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"51⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"52⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"53⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"54⤵
- Executes dropped EXE
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"55⤵
- Executes dropped EXE
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"56⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"57⤵
- Executes dropped EXE
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"58⤵
- Executes dropped EXE
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"59⤵
- Executes dropped EXE
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"60⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"61⤵
- Executes dropped EXE
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"62⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"63⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"64⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"65⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"66⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"67⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"68⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"69⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"70⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"71⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"72⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"73⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"74⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"75⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"76⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"77⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"78⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"79⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"80⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"81⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"82⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"83⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"84⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"85⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"86⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"87⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"88⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"89⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"90⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"91⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"92⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"93⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"94⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"95⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"96⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"98⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"99⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"100⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"101⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"102⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"103⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"105⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"106⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"107⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"108⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"109⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"110⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"111⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"112⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"113⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"114⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"115⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"116⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"117⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"118⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"120⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"121⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"122⤵PID:3964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-