Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe
-
Size
712KB
-
MD5
e415e1311d2cd25feb011cf3bc67894d
-
SHA1
5675d879a5aa9dcd950de0951858b54f8390650c
-
SHA256
8e753d20cc4a52c4393eaaa10a9d0c7d8e1dd3e890e464000754ab9131763457
-
SHA512
fed6dc8782cc0d63f9bc36588d68b01e5cbf6c00dadc2c17f874dda2add27e747a3987a86cb626b4947e2236741c7c3ba4fd8a8f8d8c4bf6a1192552bef59423
-
SSDEEP
12288:FU5rCOTeiDc+GmCp9IrxB39xJbqZNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJD3GzpSXNGNnCvq5TJLCvY90D8/V
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3780 373C.tmp 3304 37B9.tmp 216 3846.tmp 1844 38E2.tmp 1532 396F.tmp 3756 3A0B.tmp 5112 3AC7.tmp 3632 3B34.tmp 4596 3BC1.tmp 2728 3C2E.tmp 3452 3C9B.tmp 1788 3D09.tmp 1792 3D76.tmp 2420 3DF3.tmp 2556 3E70.tmp 3996 3EFD.tmp 5024 3F6A.tmp 2372 4006.tmp 1660 4074.tmp 1724 40E1.tmp 456 413F.tmp 1952 41CC.tmp 1812 4249.tmp 3720 42C6.tmp 4440 4352.tmp 4424 43CF.tmp 1400 446B.tmp 3584 44E8.tmp 3480 4575.tmp 3880 45D3.tmp 5116 4631.tmp 3484 469E.tmp 3960 472B.tmp 640 4779.tmp 4336 47D6.tmp 4352 4825.tmp 2444 4882.tmp 2040 48D0.tmp 892 492E.tmp 3128 498C.tmp 4012 49EA.tmp 3496 4A47.tmp 5092 4AA5.tmp 2824 4B03.tmp 956 4B61.tmp 4172 4BBE.tmp 2408 4C2C.tmp 4796 4C8A.tmp 4904 4CE7.tmp 4228 4D55.tmp 2276 4DB2.tmp 552 4E10.tmp 4188 4E7E.tmp 4908 4EDB.tmp 388 4F39.tmp 4740 4F87.tmp 2964 4FF5.tmp 2488 5052.tmp 632 50B0.tmp 4392 510E.tmp 1140 516C.tmp 4732 51C9.tmp 2332 5227.tmp 5076 5285.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3780 2432 2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe 84 PID 2432 wrote to memory of 3780 2432 2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe 84 PID 2432 wrote to memory of 3780 2432 2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe 84 PID 3780 wrote to memory of 3304 3780 373C.tmp 85 PID 3780 wrote to memory of 3304 3780 373C.tmp 85 PID 3780 wrote to memory of 3304 3780 373C.tmp 85 PID 3304 wrote to memory of 216 3304 37B9.tmp 86 PID 3304 wrote to memory of 216 3304 37B9.tmp 86 PID 3304 wrote to memory of 216 3304 37B9.tmp 86 PID 216 wrote to memory of 1844 216 3846.tmp 87 PID 216 wrote to memory of 1844 216 3846.tmp 87 PID 216 wrote to memory of 1844 216 3846.tmp 87 PID 1844 wrote to memory of 1532 1844 38E2.tmp 88 PID 1844 wrote to memory of 1532 1844 38E2.tmp 88 PID 1844 wrote to memory of 1532 1844 38E2.tmp 88 PID 1532 wrote to memory of 3756 1532 396F.tmp 90 PID 1532 wrote to memory of 3756 1532 396F.tmp 90 PID 1532 wrote to memory of 3756 1532 396F.tmp 90 PID 3756 wrote to memory of 5112 3756 3A0B.tmp 93 PID 3756 wrote to memory of 5112 3756 3A0B.tmp 93 PID 3756 wrote to memory of 5112 3756 3A0B.tmp 93 PID 5112 wrote to memory of 3632 5112 3AC7.tmp 94 PID 5112 wrote to memory of 3632 5112 3AC7.tmp 94 PID 5112 wrote to memory of 3632 5112 3AC7.tmp 94 PID 3632 wrote to memory of 4596 3632 3B34.tmp 95 PID 3632 wrote to memory of 4596 3632 3B34.tmp 95 PID 3632 wrote to memory of 4596 3632 3B34.tmp 95 PID 4596 wrote to memory of 2728 4596 3BC1.tmp 96 PID 4596 wrote to memory of 2728 4596 3BC1.tmp 96 PID 4596 wrote to memory of 2728 4596 3BC1.tmp 96 PID 2728 wrote to memory of 3452 2728 3C2E.tmp 97 PID 2728 wrote to memory of 3452 2728 3C2E.tmp 97 PID 2728 wrote to memory of 3452 2728 3C2E.tmp 97 PID 3452 wrote to memory of 1788 3452 3C9B.tmp 98 PID 3452 wrote to memory of 1788 3452 3C9B.tmp 98 PID 3452 wrote to memory of 1788 3452 3C9B.tmp 98 PID 1788 wrote to memory of 1792 1788 3D09.tmp 99 PID 1788 wrote to memory of 1792 1788 3D09.tmp 99 PID 1788 wrote to memory of 1792 1788 3D09.tmp 99 PID 1792 wrote to memory of 2420 1792 3D76.tmp 100 PID 1792 wrote to memory of 2420 1792 3D76.tmp 100 PID 1792 wrote to memory of 2420 1792 3D76.tmp 100 PID 2420 wrote to memory of 2556 2420 3DF3.tmp 102 PID 2420 wrote to memory of 2556 2420 3DF3.tmp 102 PID 2420 wrote to memory of 2556 2420 3DF3.tmp 102 PID 2556 wrote to memory of 3996 2556 3E70.tmp 103 PID 2556 wrote to memory of 3996 2556 3E70.tmp 103 PID 2556 wrote to memory of 3996 2556 3E70.tmp 103 PID 3996 wrote to memory of 5024 3996 3EFD.tmp 104 PID 3996 wrote to memory of 5024 3996 3EFD.tmp 104 PID 3996 wrote to memory of 5024 3996 3EFD.tmp 104 PID 5024 wrote to memory of 2372 5024 3F6A.tmp 105 PID 5024 wrote to memory of 2372 5024 3F6A.tmp 105 PID 5024 wrote to memory of 2372 5024 3F6A.tmp 105 PID 2372 wrote to memory of 1660 2372 4006.tmp 106 PID 2372 wrote to memory of 1660 2372 4006.tmp 106 PID 2372 wrote to memory of 1660 2372 4006.tmp 106 PID 1660 wrote to memory of 1724 1660 4074.tmp 107 PID 1660 wrote to memory of 1724 1660 4074.tmp 107 PID 1660 wrote to memory of 1724 1660 4074.tmp 107 PID 1724 wrote to memory of 456 1724 40E1.tmp 108 PID 1724 wrote to memory of 456 1724 40E1.tmp 108 PID 1724 wrote to memory of 456 1724 40E1.tmp 108 PID 456 wrote to memory of 1952 456 413F.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_e415e1311d2cd25feb011cf3bc67894d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"23⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"24⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"25⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"26⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"27⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"28⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"29⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"30⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"31⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"32⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"33⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"34⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"35⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"36⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"37⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"38⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"39⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"40⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"41⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"42⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"43⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"44⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"45⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"46⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"47⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"48⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"49⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"50⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"51⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"52⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"53⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"54⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"55⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"56⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"57⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"58⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"59⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"60⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"61⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"62⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"63⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"64⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"65⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"66⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"67⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"68⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"70⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"71⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"72⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"73⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"74⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"75⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"76⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"78⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"79⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"80⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"81⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"82⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"83⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"84⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"85⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"86⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"87⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"88⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"89⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"91⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"92⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"93⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"94⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"95⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"96⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"97⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"98⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"99⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"100⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"101⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"102⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"103⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"104⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"105⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"106⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"107⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"108⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"109⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"110⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"111⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"112⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"113⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"114⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"115⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"116⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"117⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"118⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"119⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"120⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"121⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"122⤵PID:3080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-