Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe
-
Size
520KB
-
MD5
8045e67ba8b95e430578daa3998a2e14
-
SHA1
46c8f15a2a39699fa984ffd547808643c8132310
-
SHA256
36ff599af0ecd5764b5db932d42b5b559340b57fe006721f5919131bb0ef7eb5
-
SHA512
141ecc6b6828d84711241ebaf74610d83dab7f824f307a84ae8094d568e959f1a8089a220abd0784c9d322b2232ed2bf6ec77ef53bdb3415b3312ad7b64b9d3d
-
SSDEEP
12288:gj8fuxR21t5i8flRfBeDyaqgMN58S7EY+g0/rMNZ:gj8fuK1GY0xq5kSEpgN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3044 3827.tmp 3576 3894.tmp 1852 38F2.tmp 2996 396F.tmp 5020 39CD.tmp 1896 3A59.tmp 1356 3AB7.tmp 2580 3B24.tmp 756 3B92.tmp 4940 3BF0.tmp 1224 3C6D.tmp 4744 3CBB.tmp 1528 3D38.tmp 4404 3DA5.tmp 3772 3E12.tmp 4728 3E80.tmp 3572 3EDE.tmp 3396 3F4B.tmp 1908 3FC8.tmp 1084 4045.tmp 3296 40B2.tmp 2376 4120.tmp 4216 418D.tmp 4768 4229.tmp 4968 4287.tmp 4052 42E5.tmp 4676 4343.tmp 3196 43A0.tmp 3008 43EE.tmp 1044 444C.tmp 5016 44BA.tmp 2728 4508.tmp 3076 4575.tmp 5008 45C3.tmp 4652 4611.tmp 1368 465F.tmp 116 46FC.tmp 4476 474A.tmp 1284 47A8.tmp 3720 47F6.tmp 2328 4844.tmp 3920 4892.tmp 516 48E0.tmp 4612 493E.tmp 2024 498C.tmp 3604 49DA.tmp 4488 4A38.tmp 3696 4A86.tmp 1064 4AD4.tmp 1416 4B22.tmp 3176 4B90.tmp 1876 4BED.tmp 1548 4C3B.tmp 4444 4C99.tmp 1700 4CE7.tmp 976 4D35.tmp 5116 4D93.tmp 3900 4DF1.tmp 628 4E3F.tmp 3048 4E8D.tmp 1952 4EDB.tmp 1908 4F58.tmp 436 4FB6.tmp 2360 5004.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 3044 644 2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe 83 PID 644 wrote to memory of 3044 644 2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe 83 PID 644 wrote to memory of 3044 644 2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe 83 PID 3044 wrote to memory of 3576 3044 3827.tmp 84 PID 3044 wrote to memory of 3576 3044 3827.tmp 84 PID 3044 wrote to memory of 3576 3044 3827.tmp 84 PID 3576 wrote to memory of 1852 3576 3894.tmp 85 PID 3576 wrote to memory of 1852 3576 3894.tmp 85 PID 3576 wrote to memory of 1852 3576 3894.tmp 85 PID 1852 wrote to memory of 2996 1852 38F2.tmp 86 PID 1852 wrote to memory of 2996 1852 38F2.tmp 86 PID 1852 wrote to memory of 2996 1852 38F2.tmp 86 PID 2996 wrote to memory of 5020 2996 396F.tmp 87 PID 2996 wrote to memory of 5020 2996 396F.tmp 87 PID 2996 wrote to memory of 5020 2996 396F.tmp 87 PID 5020 wrote to memory of 1896 5020 39CD.tmp 90 PID 5020 wrote to memory of 1896 5020 39CD.tmp 90 PID 5020 wrote to memory of 1896 5020 39CD.tmp 90 PID 1896 wrote to memory of 1356 1896 3A59.tmp 91 PID 1896 wrote to memory of 1356 1896 3A59.tmp 91 PID 1896 wrote to memory of 1356 1896 3A59.tmp 91 PID 1356 wrote to memory of 2580 1356 3AB7.tmp 93 PID 1356 wrote to memory of 2580 1356 3AB7.tmp 93 PID 1356 wrote to memory of 2580 1356 3AB7.tmp 93 PID 2580 wrote to memory of 756 2580 3B24.tmp 94 PID 2580 wrote to memory of 756 2580 3B24.tmp 94 PID 2580 wrote to memory of 756 2580 3B24.tmp 94 PID 756 wrote to memory of 4940 756 3B92.tmp 95 PID 756 wrote to memory of 4940 756 3B92.tmp 95 PID 756 wrote to memory of 4940 756 3B92.tmp 95 PID 4940 wrote to memory of 1224 4940 3BF0.tmp 96 PID 4940 wrote to memory of 1224 4940 3BF0.tmp 96 PID 4940 wrote to memory of 1224 4940 3BF0.tmp 96 PID 1224 wrote to memory of 4744 1224 3C6D.tmp 97 PID 1224 wrote to memory of 4744 1224 3C6D.tmp 97 PID 1224 wrote to memory of 4744 1224 3C6D.tmp 97 PID 4744 wrote to memory of 1528 4744 3CBB.tmp 98 PID 4744 wrote to memory of 1528 4744 3CBB.tmp 98 PID 4744 wrote to memory of 1528 4744 3CBB.tmp 98 PID 1528 wrote to memory of 4404 1528 3D38.tmp 99 PID 1528 wrote to memory of 4404 1528 3D38.tmp 99 PID 1528 wrote to memory of 4404 1528 3D38.tmp 99 PID 4404 wrote to memory of 3772 4404 3DA5.tmp 100 PID 4404 wrote to memory of 3772 4404 3DA5.tmp 100 PID 4404 wrote to memory of 3772 4404 3DA5.tmp 100 PID 3772 wrote to memory of 4728 3772 3E12.tmp 101 PID 3772 wrote to memory of 4728 3772 3E12.tmp 101 PID 3772 wrote to memory of 4728 3772 3E12.tmp 101 PID 4728 wrote to memory of 3572 4728 3E80.tmp 102 PID 4728 wrote to memory of 3572 4728 3E80.tmp 102 PID 4728 wrote to memory of 3572 4728 3E80.tmp 102 PID 3572 wrote to memory of 3396 3572 3EDE.tmp 103 PID 3572 wrote to memory of 3396 3572 3EDE.tmp 103 PID 3572 wrote to memory of 3396 3572 3EDE.tmp 103 PID 3396 wrote to memory of 1908 3396 3F4B.tmp 104 PID 3396 wrote to memory of 1908 3396 3F4B.tmp 104 PID 3396 wrote to memory of 1908 3396 3F4B.tmp 104 PID 1908 wrote to memory of 1084 1908 3FC8.tmp 105 PID 1908 wrote to memory of 1084 1908 3FC8.tmp 105 PID 1908 wrote to memory of 1084 1908 3FC8.tmp 105 PID 1084 wrote to memory of 3296 1084 4045.tmp 106 PID 1084 wrote to memory of 3296 1084 4045.tmp 106 PID 1084 wrote to memory of 3296 1084 4045.tmp 106 PID 3296 wrote to memory of 2376 3296 40B2.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_8045e67ba8b95e430578daa3998a2e14_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3B24.tmp"C:\Users\Admin\AppData\Local\Temp\3B24.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"23⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"24⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"25⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"26⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"27⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"28⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"29⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"30⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"31⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"32⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"33⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"34⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"35⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"36⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"37⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"38⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"39⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"40⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"41⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"42⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"43⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"44⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"45⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"46⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"47⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"48⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"49⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"50⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"51⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"52⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"53⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"54⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"55⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"56⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"57⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"58⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"59⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"60⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"61⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"62⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"63⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"65⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"66⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"67⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"68⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"69⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"70⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"71⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"72⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"73⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"74⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"75⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"76⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"77⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"78⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"79⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"80⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"81⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"82⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"83⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"84⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"85⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"86⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"87⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"88⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"89⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"90⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"91⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"92⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"93⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"94⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"95⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"96⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"97⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"98⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"99⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"101⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"102⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"103⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"104⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"105⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"106⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"107⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"108⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"109⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"110⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"111⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"112⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"113⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"114⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"115⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"116⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"117⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"118⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"119⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"120⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"121⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-