Analysis
-
max time kernel
132s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe
-
Size
488KB
-
MD5
2d6b874097a87f14e18694a346af3940
-
SHA1
c9aab27151c44dba6915c179e1db7d08c28580f3
-
SHA256
e317bdd6ef827d349daab63215eaed08edcef630e7bdcc7a43cdcfb5f40d948d
-
SHA512
32af41407f6cd0c0c0d6dbea24ecf84b51ae2b409e71127ebfddc3ebaa325c7f035a10cca8ec33927dd9e96c3552a34fc13aee1631421dec20b82055b6be62be
-
SSDEEP
12288:/U5rCOTeiDhzas5TIx93kSTRqrNCjpNZ:/UQOJDRp0ZkgqrupN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3916 3AA7.tmp 4168 3B24.tmp 228 3B82.tmp 1956 3BFF.tmp 1332 3C7C.tmp 4864 3CDA.tmp 1832 3D47.tmp 4212 3DA5.tmp 1284 3E12.tmp 2108 3E80.tmp 4272 3ECE.tmp 4164 3F1C.tmp 3784 3F99.tmp 4548 3FE7.tmp 2552 4035.tmp 4368 40A3.tmp 4728 4110.tmp 3660 416E.tmp 2012 41CC.tmp 760 4249.tmp 2396 42C6.tmp 3480 4333.tmp 4024 43A0.tmp 3644 43FE.tmp 4448 445C.tmp 1076 44AA.tmp 1432 4517.tmp 512 4594.tmp 412 45F2.tmp 4820 465F.tmp 1504 46CD.tmp 3648 4759.tmp 4612 47A8.tmp 4772 47F6.tmp 4460 4844.tmp 3244 48A2.tmp 3508 490F.tmp 3520 495D.tmp 4056 49BB.tmp 3084 4A09.tmp 4420 4A57.tmp 3308 4AB5.tmp 4204 4B03.tmp 3032 4B61.tmp 3444 4BAF.tmp 452 4BFD.tmp 3556 4C4B.tmp 1848 4C99.tmp 748 4CE7.tmp 4476 4D35.tmp 3208 4D84.tmp 4576 4DD2.tmp 3916 4E2F.tmp 2716 4E8D.tmp 4064 4EDB.tmp 1068 4F29.tmp 1272 4F87.tmp 3040 4FD5.tmp 1956 5023.tmp 2536 5072.tmp 1512 50CF.tmp 4184 511D.tmp 1464 516C.tmp 3664 51BA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3916 2268 2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe 84 PID 2268 wrote to memory of 3916 2268 2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe 84 PID 2268 wrote to memory of 3916 2268 2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe 84 PID 3916 wrote to memory of 4168 3916 3AA7.tmp 85 PID 3916 wrote to memory of 4168 3916 3AA7.tmp 85 PID 3916 wrote to memory of 4168 3916 3AA7.tmp 85 PID 4168 wrote to memory of 228 4168 3B24.tmp 87 PID 4168 wrote to memory of 228 4168 3B24.tmp 87 PID 4168 wrote to memory of 228 4168 3B24.tmp 87 PID 228 wrote to memory of 1956 228 3B82.tmp 88 PID 228 wrote to memory of 1956 228 3B82.tmp 88 PID 228 wrote to memory of 1956 228 3B82.tmp 88 PID 1956 wrote to memory of 1332 1956 3BFF.tmp 90 PID 1956 wrote to memory of 1332 1956 3BFF.tmp 90 PID 1956 wrote to memory of 1332 1956 3BFF.tmp 90 PID 1332 wrote to memory of 4864 1332 3C7C.tmp 92 PID 1332 wrote to memory of 4864 1332 3C7C.tmp 92 PID 1332 wrote to memory of 4864 1332 3C7C.tmp 92 PID 4864 wrote to memory of 1832 4864 3CDA.tmp 93 PID 4864 wrote to memory of 1832 4864 3CDA.tmp 93 PID 4864 wrote to memory of 1832 4864 3CDA.tmp 93 PID 1832 wrote to memory of 4212 1832 3D47.tmp 94 PID 1832 wrote to memory of 4212 1832 3D47.tmp 94 PID 1832 wrote to memory of 4212 1832 3D47.tmp 94 PID 4212 wrote to memory of 1284 4212 3DA5.tmp 95 PID 4212 wrote to memory of 1284 4212 3DA5.tmp 95 PID 4212 wrote to memory of 1284 4212 3DA5.tmp 95 PID 1284 wrote to memory of 2108 1284 3E12.tmp 96 PID 1284 wrote to memory of 2108 1284 3E12.tmp 96 PID 1284 wrote to memory of 2108 1284 3E12.tmp 96 PID 2108 wrote to memory of 4272 2108 3E80.tmp 97 PID 2108 wrote to memory of 4272 2108 3E80.tmp 97 PID 2108 wrote to memory of 4272 2108 3E80.tmp 97 PID 4272 wrote to memory of 4164 4272 3ECE.tmp 98 PID 4272 wrote to memory of 4164 4272 3ECE.tmp 98 PID 4272 wrote to memory of 4164 4272 3ECE.tmp 98 PID 4164 wrote to memory of 3784 4164 3F1C.tmp 99 PID 4164 wrote to memory of 3784 4164 3F1C.tmp 99 PID 4164 wrote to memory of 3784 4164 3F1C.tmp 99 PID 3784 wrote to memory of 4548 3784 3F99.tmp 100 PID 3784 wrote to memory of 4548 3784 3F99.tmp 100 PID 3784 wrote to memory of 4548 3784 3F99.tmp 100 PID 4548 wrote to memory of 2552 4548 3FE7.tmp 101 PID 4548 wrote to memory of 2552 4548 3FE7.tmp 101 PID 4548 wrote to memory of 2552 4548 3FE7.tmp 101 PID 2552 wrote to memory of 4368 2552 4035.tmp 102 PID 2552 wrote to memory of 4368 2552 4035.tmp 102 PID 2552 wrote to memory of 4368 2552 4035.tmp 102 PID 4368 wrote to memory of 4728 4368 40A3.tmp 103 PID 4368 wrote to memory of 4728 4368 40A3.tmp 103 PID 4368 wrote to memory of 4728 4368 40A3.tmp 103 PID 4728 wrote to memory of 3660 4728 4110.tmp 104 PID 4728 wrote to memory of 3660 4728 4110.tmp 104 PID 4728 wrote to memory of 3660 4728 4110.tmp 104 PID 3660 wrote to memory of 2012 3660 416E.tmp 105 PID 3660 wrote to memory of 2012 3660 416E.tmp 105 PID 3660 wrote to memory of 2012 3660 416E.tmp 105 PID 2012 wrote to memory of 760 2012 41CC.tmp 106 PID 2012 wrote to memory of 760 2012 41CC.tmp 106 PID 2012 wrote to memory of 760 2012 41CC.tmp 106 PID 760 wrote to memory of 2396 760 4249.tmp 107 PID 760 wrote to memory of 2396 760 4249.tmp 107 PID 760 wrote to memory of 2396 760 4249.tmp 107 PID 2396 wrote to memory of 3480 2396 42C6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_2d6b874097a87f14e18694a346af3940_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\3B82.tmp"C:\Users\Admin\AppData\Local\Temp\3B82.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"23⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"24⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"25⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"26⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"27⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"28⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"29⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"30⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"31⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"32⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"33⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"34⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"35⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"36⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"37⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"38⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"39⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"40⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"41⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"42⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"43⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"44⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"45⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"46⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"47⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"48⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"49⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"50⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"51⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"52⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"53⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"54⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"55⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"56⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"57⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"58⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"59⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"60⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"61⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"62⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"63⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"64⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"65⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"66⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"67⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"68⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"69⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"70⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"72⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"73⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"74⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"75⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"76⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"77⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"78⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"79⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"80⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"81⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"82⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"83⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"84⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"85⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"86⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"87⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"88⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"89⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"90⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"91⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"92⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"93⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"94⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"95⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"96⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"97⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"98⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"99⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"100⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"101⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"102⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"103⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"104⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"105⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"106⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"107⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"108⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"109⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"110⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"111⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"112⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"113⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"114⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"115⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"116⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"117⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"118⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"119⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"120⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"121⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"122⤵PID:3516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-