Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe
-
Size
487KB
-
MD5
6a66c5055a7e32718c7b0d7b9a8aa174
-
SHA1
12f344899152871a7199deed277c07762c5f00fd
-
SHA256
8311d9eb1f12f4282d921d8976080eda63dba4a9ded327a12e8033633d13ac0f
-
SHA512
c5ece6eaef49ff7c2bccfb2e172b2a7b982874856d31c30cc68efbe6038ba1438e0645f7611f6a11b5b49c76100b83e33c62c9d0fa14065ce78d937e37a04aa8
-
SSDEEP
12288:yU5rCOTeiN7+r81UA9KYyduXZpzQxFbZ:yUQOJN7oA9KYysXUzb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2772 33A3.tmp 3780 3420.tmp 5060 347D.tmp 4744 34CB.tmp 4800 351A.tmp 60 3577.tmp 2728 35D5.tmp 1716 3623.tmp 3088 3681.tmp 4108 36CF.tmp 5020 373C.tmp 2780 378B.tmp 4276 37E8.tmp 972 3856.tmp 3356 38A4.tmp 2180 3911.tmp 2996 395F.tmp 2964 39CD.tmp 1384 3A1B.tmp 3040 3A88.tmp 1484 3AF6.tmp 4028 3B73.tmp 2400 3BF0.tmp 4620 3C4D.tmp 4036 3C9B.tmp 3688 3D09.tmp 3424 3D76.tmp 552 3DF3.tmp 2692 3E41.tmp 4604 3E9F.tmp 5060 3F0C.tmp 3532 3F6A.tmp 2724 3FE7.tmp 4820 4035.tmp 4352 4083.tmp 1432 40D2.tmp 3156 412F.tmp 2780 417D.tmp 740 420A.tmp 3916 4277.tmp 3020 42C6.tmp 4376 4323.tmp 4004 4371.tmp 2804 43CF.tmp 2040 442D.tmp 4160 448B.tmp 3616 44D9.tmp 404 4527.tmp 1484 4575.tmp 3552 45C3.tmp 2492 4621.tmp 4908 467F.tmp 5072 46DC.tmp 3172 473A.tmp 5112 4798.tmp 436 47F6.tmp 1916 4844.tmp 1932 48A2.tmp 4672 48FF.tmp 4556 495D.tmp 1136 49BB.tmp 3568 4A09.tmp 5060 4A57.tmp 1896 4AA5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 2772 3252 2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe 87 PID 3252 wrote to memory of 2772 3252 2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe 87 PID 3252 wrote to memory of 2772 3252 2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe 87 PID 2772 wrote to memory of 3780 2772 33A3.tmp 88 PID 2772 wrote to memory of 3780 2772 33A3.tmp 88 PID 2772 wrote to memory of 3780 2772 33A3.tmp 88 PID 3780 wrote to memory of 5060 3780 3420.tmp 90 PID 3780 wrote to memory of 5060 3780 3420.tmp 90 PID 3780 wrote to memory of 5060 3780 3420.tmp 90 PID 5060 wrote to memory of 4744 5060 347D.tmp 92 PID 5060 wrote to memory of 4744 5060 347D.tmp 92 PID 5060 wrote to memory of 4744 5060 347D.tmp 92 PID 4744 wrote to memory of 4800 4744 34CB.tmp 93 PID 4744 wrote to memory of 4800 4744 34CB.tmp 93 PID 4744 wrote to memory of 4800 4744 34CB.tmp 93 PID 4800 wrote to memory of 60 4800 351A.tmp 95 PID 4800 wrote to memory of 60 4800 351A.tmp 95 PID 4800 wrote to memory of 60 4800 351A.tmp 95 PID 60 wrote to memory of 2728 60 3577.tmp 96 PID 60 wrote to memory of 2728 60 3577.tmp 96 PID 60 wrote to memory of 2728 60 3577.tmp 96 PID 2728 wrote to memory of 1716 2728 35D5.tmp 97 PID 2728 wrote to memory of 1716 2728 35D5.tmp 97 PID 2728 wrote to memory of 1716 2728 35D5.tmp 97 PID 1716 wrote to memory of 3088 1716 3623.tmp 98 PID 1716 wrote to memory of 3088 1716 3623.tmp 98 PID 1716 wrote to memory of 3088 1716 3623.tmp 98 PID 3088 wrote to memory of 4108 3088 3681.tmp 99 PID 3088 wrote to memory of 4108 3088 3681.tmp 99 PID 3088 wrote to memory of 4108 3088 3681.tmp 99 PID 4108 wrote to memory of 5020 4108 36CF.tmp 100 PID 4108 wrote to memory of 5020 4108 36CF.tmp 100 PID 4108 wrote to memory of 5020 4108 36CF.tmp 100 PID 5020 wrote to memory of 2780 5020 373C.tmp 101 PID 5020 wrote to memory of 2780 5020 373C.tmp 101 PID 5020 wrote to memory of 2780 5020 373C.tmp 101 PID 2780 wrote to memory of 4276 2780 378B.tmp 102 PID 2780 wrote to memory of 4276 2780 378B.tmp 102 PID 2780 wrote to memory of 4276 2780 378B.tmp 102 PID 4276 wrote to memory of 972 4276 37E8.tmp 103 PID 4276 wrote to memory of 972 4276 37E8.tmp 103 PID 4276 wrote to memory of 972 4276 37E8.tmp 103 PID 972 wrote to memory of 3356 972 3856.tmp 104 PID 972 wrote to memory of 3356 972 3856.tmp 104 PID 972 wrote to memory of 3356 972 3856.tmp 104 PID 3356 wrote to memory of 2180 3356 38A4.tmp 105 PID 3356 wrote to memory of 2180 3356 38A4.tmp 105 PID 3356 wrote to memory of 2180 3356 38A4.tmp 105 PID 2180 wrote to memory of 2996 2180 3911.tmp 106 PID 2180 wrote to memory of 2996 2180 3911.tmp 106 PID 2180 wrote to memory of 2996 2180 3911.tmp 106 PID 2996 wrote to memory of 2964 2996 395F.tmp 108 PID 2996 wrote to memory of 2964 2996 395F.tmp 108 PID 2996 wrote to memory of 2964 2996 395F.tmp 108 PID 2964 wrote to memory of 1384 2964 39CD.tmp 109 PID 2964 wrote to memory of 1384 2964 39CD.tmp 109 PID 2964 wrote to memory of 1384 2964 39CD.tmp 109 PID 1384 wrote to memory of 3040 1384 3A1B.tmp 112 PID 1384 wrote to memory of 3040 1384 3A1B.tmp 112 PID 1384 wrote to memory of 3040 1384 3A1B.tmp 112 PID 3040 wrote to memory of 1484 3040 3A88.tmp 113 PID 3040 wrote to memory of 1484 3040 3A88.tmp 113 PID 3040 wrote to memory of 1484 3040 3A88.tmp 113 PID 1484 wrote to memory of 4028 1484 3AF6.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_6a66c5055a7e32718c7b0d7b9a8aa174_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"23⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"24⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"25⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"26⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"27⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"28⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"29⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"30⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"31⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"32⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"33⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"34⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"35⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"36⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"37⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"38⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"39⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"40⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"41⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"42⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"43⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"44⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"45⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"46⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"47⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"48⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"49⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"50⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"51⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"52⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"53⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"54⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"55⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"56⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"57⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"58⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"59⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"60⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"61⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"62⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"63⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"64⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"65⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"66⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"67⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"68⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"69⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"70⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"71⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"72⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"73⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"74⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"75⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"76⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"77⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"78⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"79⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"80⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"81⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"82⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"83⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"84⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"85⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"86⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"87⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"88⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"89⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"90⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"91⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"92⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"93⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"94⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"95⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"96⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"97⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"98⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"99⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"101⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"102⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"103⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"104⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"105⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"106⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"107⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"108⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"109⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"110⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"111⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"112⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"113⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"114⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"115⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"116⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"117⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"118⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"119⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"120⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"121⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-