Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 19:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe
-
Size
486KB
-
MD5
5ab05c9498f542a01653669a395ef8c6
-
SHA1
4f8b9eaaf6e6cc0173a83fc199a3ebfe8631633e
-
SHA256
febccf7bcce69051ac3e49c3ec9188f4b1e04e023ae99b8b1d5a1d943c73e386
-
SHA512
5d852e29646de4670c4f945da9dc8c49b5d5aebb599a87e4a0bafd2fd7396f9ceb024ab3cc8936df7b57c0bb53e68bc2dc69bc02067a431a4e6fc97e04a5e640
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7g0lSZiV07d/YRRdQYCaM9I8j7TThusH3dZ:UU5rCOTeiDgeLVs/YVQYO9rfTJNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1176 36A0.tmp 1572 372D.tmp 3940 378B.tmp 2016 37E8.tmp 4844 3836.tmp 4776 38A4.tmp 4640 3902.tmp 4212 3950.tmp 2220 399E.tmp 4752 39FC.tmp 3832 3A59.tmp 2188 3AB7.tmp 3028 3B24.tmp 632 3B73.tmp 2632 3BE0.tmp 2036 3C4D.tmp 5104 3CAB.tmp 4880 3D28.tmp 4328 3D76.tmp 4320 3DF3.tmp 1532 3E61.tmp 2660 3EBE.tmp 4592 3F0C.tmp 4944 3F6A.tmp 3392 3FC8.tmp 3932 4026.tmp 116 4093.tmp 3328 4100.tmp 3796 415E.tmp 1376 41AC.tmp 4572 421A.tmp 972 4268.tmp 1188 42C6.tmp 4968 4314.tmp 2012 4371.tmp 3232 43C0.tmp 2836 440E.tmp 4280 446B.tmp 1964 44BA.tmp 2656 4508.tmp 1036 4556.tmp 3628 45B4.tmp 2188 4602.tmp 3352 465F.tmp 4612 46BD.tmp 4828 470B.tmp 1712 4769.tmp 2904 47C7.tmp 4524 4815.tmp 1092 4873.tmp 4580 48D0.tmp 4532 492E.tmp 4328 498C.tmp 4564 49DA.tmp 3556 4A28.tmp 3392 4A76.tmp 2404 4AD4.tmp 1504 4B32.tmp 4272 4B90.tmp 904 4BDE.tmp 1840 4C3B.tmp 2200 4C99.tmp 3828 4CF7.tmp 2600 4D55.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1176 2912 2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe 85 PID 2912 wrote to memory of 1176 2912 2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe 85 PID 2912 wrote to memory of 1176 2912 2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe 85 PID 1176 wrote to memory of 1572 1176 36A0.tmp 86 PID 1176 wrote to memory of 1572 1176 36A0.tmp 86 PID 1176 wrote to memory of 1572 1176 36A0.tmp 86 PID 1572 wrote to memory of 3940 1572 372D.tmp 87 PID 1572 wrote to memory of 3940 1572 372D.tmp 87 PID 1572 wrote to memory of 3940 1572 372D.tmp 87 PID 3940 wrote to memory of 2016 3940 378B.tmp 88 PID 3940 wrote to memory of 2016 3940 378B.tmp 88 PID 3940 wrote to memory of 2016 3940 378B.tmp 88 PID 2016 wrote to memory of 4844 2016 37E8.tmp 90 PID 2016 wrote to memory of 4844 2016 37E8.tmp 90 PID 2016 wrote to memory of 4844 2016 37E8.tmp 90 PID 4844 wrote to memory of 4776 4844 3836.tmp 92 PID 4844 wrote to memory of 4776 4844 3836.tmp 92 PID 4844 wrote to memory of 4776 4844 3836.tmp 92 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4776 wrote to memory of 4640 4776 38A4.tmp 94 PID 4640 wrote to memory of 4212 4640 3902.tmp 95 PID 4640 wrote to memory of 4212 4640 3902.tmp 95 PID 4640 wrote to memory of 4212 4640 3902.tmp 95 PID 4212 wrote to memory of 2220 4212 3950.tmp 96 PID 4212 wrote to memory of 2220 4212 3950.tmp 96 PID 4212 wrote to memory of 2220 4212 3950.tmp 96 PID 2220 wrote to memory of 4752 2220 399E.tmp 97 PID 2220 wrote to memory of 4752 2220 399E.tmp 97 PID 2220 wrote to memory of 4752 2220 399E.tmp 97 PID 4752 wrote to memory of 3832 4752 39FC.tmp 98 PID 4752 wrote to memory of 3832 4752 39FC.tmp 98 PID 4752 wrote to memory of 3832 4752 39FC.tmp 98 PID 3832 wrote to memory of 2188 3832 3A59.tmp 99 PID 3832 wrote to memory of 2188 3832 3A59.tmp 99 PID 3832 wrote to memory of 2188 3832 3A59.tmp 99 PID 2188 wrote to memory of 3028 2188 3AB7.tmp 100 PID 2188 wrote to memory of 3028 2188 3AB7.tmp 100 PID 2188 wrote to memory of 3028 2188 3AB7.tmp 100 PID 3028 wrote to memory of 632 3028 3B24.tmp 101 PID 3028 wrote to memory of 632 3028 3B24.tmp 101 PID 3028 wrote to memory of 632 3028 3B24.tmp 101 PID 632 wrote to memory of 2632 632 3B73.tmp 103 PID 632 wrote to memory of 2632 632 3B73.tmp 103 PID 632 wrote to memory of 2632 632 3B73.tmp 103 PID 2632 wrote to memory of 2036 2632 3BE0.tmp 104 PID 2632 wrote to memory of 2036 2632 3BE0.tmp 104 PID 2632 wrote to memory of 2036 2632 3BE0.tmp 104 PID 2036 wrote to memory of 5104 2036 3C4D.tmp 105 PID 2036 wrote to memory of 5104 2036 3C4D.tmp 105 PID 2036 wrote to memory of 5104 2036 3C4D.tmp 105 PID 5104 wrote to memory of 4880 5104 3CAB.tmp 106 PID 5104 wrote to memory of 4880 5104 3CAB.tmp 106 PID 5104 wrote to memory of 4880 5104 3CAB.tmp 106 PID 4880 wrote to memory of 4328 4880 3D28.tmp 107 PID 4880 wrote to memory of 4328 4880 3D28.tmp 107 PID 4880 wrote to memory of 4328 4880 3D28.tmp 107 PID 4328 wrote to memory of 4320 4328 3D76.tmp 108 PID 4328 wrote to memory of 4320 4328 3D76.tmp 108 PID 4328 wrote to memory of 4320 4328 3D76.tmp 108 PID 4320 wrote to memory of 1532 4320 3DF3.tmp 109 PID 4320 wrote to memory of 1532 4320 3DF3.tmp 109 PID 4320 wrote to memory of 1532 4320 3DF3.tmp 109 PID 1532 wrote to memory of 2660 1532 3E61.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_5ab05c9498f542a01653669a395ef8c6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"23⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"24⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"25⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"26⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"27⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"28⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"29⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"30⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"31⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"32⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"33⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"34⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"35⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"36⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"37⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"38⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"39⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"40⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"41⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"42⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"43⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"44⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"45⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"46⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"47⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"48⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"49⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"50⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"51⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"52⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"53⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"54⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"55⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"56⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"57⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"58⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"59⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"60⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"61⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"62⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"63⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"64⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"65⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"66⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"67⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"68⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"69⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"70⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"71⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"72⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"73⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"74⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"75⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"76⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"77⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"78⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"79⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"80⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"81⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"82⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"83⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"84⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"85⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"86⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"87⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"88⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"89⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"90⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"91⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"92⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"93⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"94⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"95⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"96⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"97⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"98⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"99⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"100⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"101⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"102⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"103⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"104⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"105⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"106⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"107⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"108⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"109⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"110⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"111⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"112⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"113⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"114⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"115⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"116⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"117⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"118⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"119⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"120⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"121⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"122⤵PID:3316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-