Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe
-
Size
712KB
-
MD5
916d4f513ec46ecf6d2e6ce8a0ee24c9
-
SHA1
9c49033a927bfcc56dca9d4bd4fe0ea317109882
-
SHA256
fd46fe90b99cfb4978f5e4e2110f2bb771a660aa01ee745d3dfb6a1c08f98245
-
SHA512
fda1ca71b446aa7755dca2670f06c62e4f564796e4a780203f073d754978a227ffa996e1dc7594e654493147cb57939338198c99cd03cb825d4664f2514a4636
-
SSDEEP
12288:FU5rCOTeiDvhC8xmaYi1lF2xjrhNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDvRUji1lQxrhNnCvq5TJLCvY90E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3240 3D95.tmp 3052 3DF3.tmp 1544 3E80.tmp 2896 3EFD.tmp 4156 3F5B.tmp 4248 3FC8.tmp 1648 4035.tmp 2728 40A3.tmp 3100 40F1.tmp 2268 415E.tmp 2852 41CC.tmp 5028 4239.tmp 4516 42C6.tmp 4756 4333.tmp 3160 4391.tmp 2944 43EE.tmp 2212 445C.tmp 1100 44D9.tmp 912 4527.tmp 3792 4594.tmp 1980 4621.tmp 4076 46AE.tmp 1240 470B.tmp 4000 4769.tmp 4412 47B7.tmp 1736 4805.tmp 5068 4853.tmp 4720 48F0.tmp 5032 493E.tmp 428 49BB.tmp 1408 4A38.tmp 4640 4AA5.tmp 2188 4B13.tmp 3052 4B61.tmp 3328 4BBE.tmp 1668 4C0D.tmp 4248 4C5B.tmp 1568 4CB8.tmp 2464 4D07.tmp 2904 4D55.tmp 5028 4DA3.tmp 2056 4E01.tmp 1504 4E4F.tmp 4084 4EAC.tmp 3160 4F0A.tmp 2692 4F58.tmp 1332 4FA6.tmp 1028 4FF5.tmp 4492 5043.tmp 4112 5091.tmp 4412 50DF.tmp 5000 514C.tmp 3708 519A.tmp 388 51E9.tmp 1600 5246.tmp 3064 52A4.tmp 2236 52F2.tmp 4604 5350.tmp 4476 53AE.tmp 5032 540B.tmp 3380 545A.tmp 4316 54B7.tmp 1500 5505.tmp 1748 5563.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3240 1752 2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe 84 PID 1752 wrote to memory of 3240 1752 2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe 84 PID 1752 wrote to memory of 3240 1752 2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe 84 PID 3240 wrote to memory of 3052 3240 3D95.tmp 85 PID 3240 wrote to memory of 3052 3240 3D95.tmp 85 PID 3240 wrote to memory of 3052 3240 3D95.tmp 85 PID 3052 wrote to memory of 1544 3052 3DF3.tmp 87 PID 3052 wrote to memory of 1544 3052 3DF3.tmp 87 PID 3052 wrote to memory of 1544 3052 3DF3.tmp 87 PID 1544 wrote to memory of 2896 1544 3E80.tmp 88 PID 1544 wrote to memory of 2896 1544 3E80.tmp 88 PID 1544 wrote to memory of 2896 1544 3E80.tmp 88 PID 2896 wrote to memory of 4156 2896 3EFD.tmp 90 PID 2896 wrote to memory of 4156 2896 3EFD.tmp 90 PID 2896 wrote to memory of 4156 2896 3EFD.tmp 90 PID 4156 wrote to memory of 4248 4156 3F5B.tmp 92 PID 4156 wrote to memory of 4248 4156 3F5B.tmp 92 PID 4156 wrote to memory of 4248 4156 3F5B.tmp 92 PID 4248 wrote to memory of 1648 4248 3FC8.tmp 94 PID 4248 wrote to memory of 1648 4248 3FC8.tmp 94 PID 4248 wrote to memory of 1648 4248 3FC8.tmp 94 PID 1648 wrote to memory of 2728 1648 4035.tmp 95 PID 1648 wrote to memory of 2728 1648 4035.tmp 95 PID 1648 wrote to memory of 2728 1648 4035.tmp 95 PID 2728 wrote to memory of 3100 2728 40A3.tmp 97 PID 2728 wrote to memory of 3100 2728 40A3.tmp 97 PID 2728 wrote to memory of 3100 2728 40A3.tmp 97 PID 3100 wrote to memory of 2268 3100 40F1.tmp 98 PID 3100 wrote to memory of 2268 3100 40F1.tmp 98 PID 3100 wrote to memory of 2268 3100 40F1.tmp 98 PID 2268 wrote to memory of 2852 2268 415E.tmp 99 PID 2268 wrote to memory of 2852 2268 415E.tmp 99 PID 2268 wrote to memory of 2852 2268 415E.tmp 99 PID 2852 wrote to memory of 5028 2852 41CC.tmp 100 PID 2852 wrote to memory of 5028 2852 41CC.tmp 100 PID 2852 wrote to memory of 5028 2852 41CC.tmp 100 PID 5028 wrote to memory of 4516 5028 4239.tmp 101 PID 5028 wrote to memory of 4516 5028 4239.tmp 101 PID 5028 wrote to memory of 4516 5028 4239.tmp 101 PID 4516 wrote to memory of 4756 4516 42C6.tmp 102 PID 4516 wrote to memory of 4756 4516 42C6.tmp 102 PID 4516 wrote to memory of 4756 4516 42C6.tmp 102 PID 4756 wrote to memory of 3160 4756 4333.tmp 103 PID 4756 wrote to memory of 3160 4756 4333.tmp 103 PID 4756 wrote to memory of 3160 4756 4333.tmp 103 PID 3160 wrote to memory of 2944 3160 4391.tmp 104 PID 3160 wrote to memory of 2944 3160 4391.tmp 104 PID 3160 wrote to memory of 2944 3160 4391.tmp 104 PID 2944 wrote to memory of 2212 2944 43EE.tmp 105 PID 2944 wrote to memory of 2212 2944 43EE.tmp 105 PID 2944 wrote to memory of 2212 2944 43EE.tmp 105 PID 2212 wrote to memory of 1100 2212 445C.tmp 106 PID 2212 wrote to memory of 1100 2212 445C.tmp 106 PID 2212 wrote to memory of 1100 2212 445C.tmp 106 PID 1100 wrote to memory of 912 1100 44D9.tmp 107 PID 1100 wrote to memory of 912 1100 44D9.tmp 107 PID 1100 wrote to memory of 912 1100 44D9.tmp 107 PID 912 wrote to memory of 3792 912 4527.tmp 108 PID 912 wrote to memory of 3792 912 4527.tmp 108 PID 912 wrote to memory of 3792 912 4527.tmp 108 PID 3792 wrote to memory of 1980 3792 4594.tmp 109 PID 3792 wrote to memory of 1980 3792 4594.tmp 109 PID 3792 wrote to memory of 1980 3792 4594.tmp 109 PID 1980 wrote to memory of 4076 1980 4621.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-07_916d4f513ec46ecf6d2e6ce8a0ee24c9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"23⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"24⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"25⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"26⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"27⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"28⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"29⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"30⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"31⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"32⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"33⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"34⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"35⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"36⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"37⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"38⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"39⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"40⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"41⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"42⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"43⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"44⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"45⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"46⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"47⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"48⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"49⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"50⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"51⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"52⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"53⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"54⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"55⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"56⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"57⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"58⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"59⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"60⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"61⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"62⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"63⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"64⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"65⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"66⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"67⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"68⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"69⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"70⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"71⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"72⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"73⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"74⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"75⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"76⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"77⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"78⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"80⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"81⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"82⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"83⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"84⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"85⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"86⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"87⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"88⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"89⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"90⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"91⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"92⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"93⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"94⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"95⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"96⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"97⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"98⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"99⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"100⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"101⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"102⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"103⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"104⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"105⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"106⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"107⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"108⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"109⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"110⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"111⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"112⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"113⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"114⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"116⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"117⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"118⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"119⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"120⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"121⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"122⤵PID:4724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-