Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe
-
Size
527KB
-
MD5
5fa22a85333430341f4df04af66d37ca
-
SHA1
7893a790abaf7d1949b96d44d0f5e6f6e2690ba1
-
SHA256
f2d247859de72d7de48645b94df6c9c587882c12f307ec8de1fe1bd0564dd8bd
-
SHA512
3817dfe39d80646b71bf4fc331796e8de1febfe720b87629ae9f1edaad1fc42535aa8455250f5ba12a9f2a8304ecb9b7d496e7341ba8e887f2ae65d9b8f7ce7a
-
SSDEEP
12288:fU5rCOTeidoyQmZzL9bemS31zH7GLSDZu:fUQOJd7QmrbemmSSDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3388 36FE.tmp 2020 378B.tmp 1296 37E8.tmp 1904 3885.tmp 1892 3902.tmp 4900 395F.tmp 2052 39DC.tmp 2732 3A79.tmp 4120 3AF6.tmp 1076 3B63.tmp 4292 3BF0.tmp 4180 3C5D.tmp 3184 3CF9.tmp 440 3D57.tmp 916 3DD4.tmp 2716 3E61.tmp 4476 3EDE.tmp 3924 3F3B.tmp 5080 3F89.tmp 1952 3FE7.tmp 2572 4074.tmp 1896 40C2.tmp 3576 413F.tmp 2496 419D.tmp 4460 4229.tmp 3312 42B6.tmp 4592 4314.tmp 4056 4362.tmp 788 440E.tmp 4868 446B.tmp 232 44D9.tmp 1256 4556.tmp 4068 45D3.tmp 3388 4640.tmp 2912 468E.tmp 2516 46EC.tmp 4644 474A.tmp 2452 4798.tmp 4072 47E6.tmp 776 4844.tmp 3104 48A2.tmp 4540 48F0.tmp 2216 497C.tmp 364 49EA.tmp 5048 4A38.tmp 2584 4AA5.tmp 4852 4B03.tmp 4124 4B70.tmp 4476 4BCE.tmp 984 4C2C.tmp 1712 4CA9.tmp 2948 4D07.tmp 3528 4D55.tmp 436 4DB2.tmp 2132 4E01.tmp 3492 4E5E.tmp 2684 4ECC.tmp 2504 4F1A.tmp 3196 4F78.tmp 4184 4FD5.tmp 3680 5033.tmp 1004 5091.tmp 3312 50EF.tmp 3684 514C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 3388 3616 2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe 82 PID 3616 wrote to memory of 3388 3616 2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe 82 PID 3616 wrote to memory of 3388 3616 2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe 82 PID 3388 wrote to memory of 2020 3388 36FE.tmp 84 PID 3388 wrote to memory of 2020 3388 36FE.tmp 84 PID 3388 wrote to memory of 2020 3388 36FE.tmp 84 PID 2020 wrote to memory of 1296 2020 378B.tmp 85 PID 2020 wrote to memory of 1296 2020 378B.tmp 85 PID 2020 wrote to memory of 1296 2020 378B.tmp 85 PID 1296 wrote to memory of 1904 1296 37E8.tmp 87 PID 1296 wrote to memory of 1904 1296 37E8.tmp 87 PID 1296 wrote to memory of 1904 1296 37E8.tmp 87 PID 1904 wrote to memory of 1892 1904 3885.tmp 88 PID 1904 wrote to memory of 1892 1904 3885.tmp 88 PID 1904 wrote to memory of 1892 1904 3885.tmp 88 PID 1892 wrote to memory of 4900 1892 3902.tmp 89 PID 1892 wrote to memory of 4900 1892 3902.tmp 89 PID 1892 wrote to memory of 4900 1892 3902.tmp 89 PID 4900 wrote to memory of 2052 4900 395F.tmp 91 PID 4900 wrote to memory of 2052 4900 395F.tmp 91 PID 4900 wrote to memory of 2052 4900 395F.tmp 91 PID 2052 wrote to memory of 2732 2052 39DC.tmp 93 PID 2052 wrote to memory of 2732 2052 39DC.tmp 93 PID 2052 wrote to memory of 2732 2052 39DC.tmp 93 PID 2732 wrote to memory of 4120 2732 3A79.tmp 94 PID 2732 wrote to memory of 4120 2732 3A79.tmp 94 PID 2732 wrote to memory of 4120 2732 3A79.tmp 94 PID 4120 wrote to memory of 1076 4120 3AF6.tmp 95 PID 4120 wrote to memory of 1076 4120 3AF6.tmp 95 PID 4120 wrote to memory of 1076 4120 3AF6.tmp 95 PID 1076 wrote to memory of 4292 1076 3B63.tmp 96 PID 1076 wrote to memory of 4292 1076 3B63.tmp 96 PID 1076 wrote to memory of 4292 1076 3B63.tmp 96 PID 4292 wrote to memory of 4180 4292 3BF0.tmp 97 PID 4292 wrote to memory of 4180 4292 3BF0.tmp 97 PID 4292 wrote to memory of 4180 4292 3BF0.tmp 97 PID 4180 wrote to memory of 3184 4180 3C5D.tmp 98 PID 4180 wrote to memory of 3184 4180 3C5D.tmp 98 PID 4180 wrote to memory of 3184 4180 3C5D.tmp 98 PID 3184 wrote to memory of 440 3184 3CF9.tmp 99 PID 3184 wrote to memory of 440 3184 3CF9.tmp 99 PID 3184 wrote to memory of 440 3184 3CF9.tmp 99 PID 440 wrote to memory of 916 440 3D57.tmp 100 PID 440 wrote to memory of 916 440 3D57.tmp 100 PID 440 wrote to memory of 916 440 3D57.tmp 100 PID 916 wrote to memory of 2716 916 3DD4.tmp 101 PID 916 wrote to memory of 2716 916 3DD4.tmp 101 PID 916 wrote to memory of 2716 916 3DD4.tmp 101 PID 2716 wrote to memory of 4476 2716 3E61.tmp 102 PID 2716 wrote to memory of 4476 2716 3E61.tmp 102 PID 2716 wrote to memory of 4476 2716 3E61.tmp 102 PID 4476 wrote to memory of 3924 4476 3EDE.tmp 103 PID 4476 wrote to memory of 3924 4476 3EDE.tmp 103 PID 4476 wrote to memory of 3924 4476 3EDE.tmp 103 PID 3924 wrote to memory of 5080 3924 3F3B.tmp 104 PID 3924 wrote to memory of 5080 3924 3F3B.tmp 104 PID 3924 wrote to memory of 5080 3924 3F3B.tmp 104 PID 5080 wrote to memory of 1952 5080 3F89.tmp 105 PID 5080 wrote to memory of 1952 5080 3F89.tmp 105 PID 5080 wrote to memory of 1952 5080 3F89.tmp 105 PID 1952 wrote to memory of 2572 1952 3FE7.tmp 107 PID 1952 wrote to memory of 2572 1952 3FE7.tmp 107 PID 1952 wrote to memory of 2572 1952 3FE7.tmp 107 PID 2572 wrote to memory of 1896 2572 4074.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_5fa22a85333430341f4df04af66d37ca_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3885.tmp"C:\Users\Admin\AppData\Local\Temp\3885.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"23⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"24⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"25⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"26⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"27⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"28⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"29⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"30⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"31⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"32⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"33⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"34⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"35⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"36⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"37⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"38⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"39⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"40⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"41⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"42⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"43⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"44⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"45⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"46⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"47⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"48⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"49⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"50⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"51⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"52⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"53⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"54⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"55⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"56⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"57⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"58⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"59⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"60⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"61⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"62⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"63⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"64⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"65⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"66⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"67⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"68⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"69⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"71⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"72⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"73⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"74⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"75⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"76⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"77⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"79⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"80⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"81⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"82⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"83⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"84⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"85⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"86⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"87⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"88⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"89⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"90⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"91⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"92⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"93⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"94⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"95⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"97⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"98⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"99⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"100⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"102⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"103⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"104⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"105⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"106⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"107⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"108⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"109⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"110⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"111⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"112⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"113⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"114⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"115⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"116⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"117⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"118⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"119⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"120⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"121⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"122⤵PID:4588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-