Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe
-
Size
527KB
-
MD5
731765af2acf6cba9c0d00f19b94d029
-
SHA1
a89fe6fd00e890ebdc2cd6775b942cf35ddc682c
-
SHA256
4ed5512b6b278f488bb0c89827cf9815d2d74e9894658d706f51f64d1ca89bb8
-
SHA512
4699e1d874fe64ab72e65a5e48b11dcf36bbffaf0c8e9a0ed9ee11e18cf5cc2538d9fef96c5072d22cdd7d71f6b28a6598dfd658b2c6d7d7c900baddf454b42f
-
SSDEEP
12288:fU5rCOTeidNlVvGXeTv3CfSPtOOQA8is0cWIKDZu:fUQOJdNlMeLSfSRQ7/WIKDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2228 396F.tmp 3540 39FC.tmp 1964 3A59.tmp 4844 3AB7.tmp 4604 3B15.tmp 2340 3B92.tmp 5088 3BF0.tmp 4688 3C7C.tmp 3048 3CCA.tmp 2472 3D38.tmp 3976 3D95.tmp 2292 3DE4.tmp 1164 3E41.tmp 4944 3E8F.tmp 3224 3EDE.tmp 4400 3F2C.tmp 4472 3F89.tmp 4248 3FE7.tmp 1636 4035.tmp 5056 4093.tmp 4704 40E1.tmp 2356 415E.tmp 1540 41AC.tmp 3920 41FA.tmp 628 4249.tmp 4028 4297.tmp 4436 42F4.tmp 1584 4343.tmp 1900 4391.tmp 3496 43DF.tmp 2500 443D.tmp 5092 449A.tmp 1400 44F8.tmp 4568 4546.tmp 1592 4594.tmp 2628 45E2.tmp 4536 4640.tmp 3588 468E.tmp 2520 46EC.tmp 3768 4759.tmp 1744 47A8.tmp 3540 4825.tmp 3344 4882.tmp 3188 48D0.tmp 3912 491F.tmp 748 496D.tmp 4988 49BB.tmp 2472 49F9.tmp 4552 4A38.tmp 2516 4A86.tmp 4460 4AE4.tmp 4944 4B32.tmp 3224 4B80.tmp 4280 4BDE.tmp 4596 4C2C.tmp 1976 4C7A.tmp 4032 4CD8.tmp 5056 4D26.tmp 3164 4D84.tmp 3756 4DE1.tmp 3352 4E2F.tmp 3316 4E7E.tmp 4076 4EDB.tmp 1308 4F29.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 2228 4200 2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe 83 PID 4200 wrote to memory of 2228 4200 2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe 83 PID 4200 wrote to memory of 2228 4200 2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe 83 PID 2228 wrote to memory of 3540 2228 396F.tmp 84 PID 2228 wrote to memory of 3540 2228 396F.tmp 84 PID 2228 wrote to memory of 3540 2228 396F.tmp 84 PID 3540 wrote to memory of 1964 3540 39FC.tmp 85 PID 3540 wrote to memory of 1964 3540 39FC.tmp 85 PID 3540 wrote to memory of 1964 3540 39FC.tmp 85 PID 1964 wrote to memory of 4844 1964 3A59.tmp 87 PID 1964 wrote to memory of 4844 1964 3A59.tmp 87 PID 1964 wrote to memory of 4844 1964 3A59.tmp 87 PID 4844 wrote to memory of 4604 4844 3AB7.tmp 88 PID 4844 wrote to memory of 4604 4844 3AB7.tmp 88 PID 4844 wrote to memory of 4604 4844 3AB7.tmp 88 PID 4604 wrote to memory of 2340 4604 3B15.tmp 89 PID 4604 wrote to memory of 2340 4604 3B15.tmp 89 PID 4604 wrote to memory of 2340 4604 3B15.tmp 89 PID 2340 wrote to memory of 5088 2340 3B92.tmp 90 PID 2340 wrote to memory of 5088 2340 3B92.tmp 90 PID 2340 wrote to memory of 5088 2340 3B92.tmp 90 PID 5088 wrote to memory of 4688 5088 3BF0.tmp 92 PID 5088 wrote to memory of 4688 5088 3BF0.tmp 92 PID 5088 wrote to memory of 4688 5088 3BF0.tmp 92 PID 4688 wrote to memory of 3048 4688 3C7C.tmp 93 PID 4688 wrote to memory of 3048 4688 3C7C.tmp 93 PID 4688 wrote to memory of 3048 4688 3C7C.tmp 93 PID 3048 wrote to memory of 2472 3048 3CCA.tmp 94 PID 3048 wrote to memory of 2472 3048 3CCA.tmp 94 PID 3048 wrote to memory of 2472 3048 3CCA.tmp 94 PID 2472 wrote to memory of 3976 2472 3D38.tmp 95 PID 2472 wrote to memory of 3976 2472 3D38.tmp 95 PID 2472 wrote to memory of 3976 2472 3D38.tmp 95 PID 3976 wrote to memory of 2292 3976 3D95.tmp 96 PID 3976 wrote to memory of 2292 3976 3D95.tmp 96 PID 3976 wrote to memory of 2292 3976 3D95.tmp 96 PID 2292 wrote to memory of 1164 2292 3DE4.tmp 97 PID 2292 wrote to memory of 1164 2292 3DE4.tmp 97 PID 2292 wrote to memory of 1164 2292 3DE4.tmp 97 PID 1164 wrote to memory of 4944 1164 3E41.tmp 98 PID 1164 wrote to memory of 4944 1164 3E41.tmp 98 PID 1164 wrote to memory of 4944 1164 3E41.tmp 98 PID 4944 wrote to memory of 3224 4944 3E8F.tmp 99 PID 4944 wrote to memory of 3224 4944 3E8F.tmp 99 PID 4944 wrote to memory of 3224 4944 3E8F.tmp 99 PID 3224 wrote to memory of 4400 3224 3EDE.tmp 100 PID 3224 wrote to memory of 4400 3224 3EDE.tmp 100 PID 3224 wrote to memory of 4400 3224 3EDE.tmp 100 PID 4400 wrote to memory of 4472 4400 3F2C.tmp 101 PID 4400 wrote to memory of 4472 4400 3F2C.tmp 101 PID 4400 wrote to memory of 4472 4400 3F2C.tmp 101 PID 4472 wrote to memory of 4248 4472 3F89.tmp 102 PID 4472 wrote to memory of 4248 4472 3F89.tmp 102 PID 4472 wrote to memory of 4248 4472 3F89.tmp 102 PID 4248 wrote to memory of 1636 4248 3FE7.tmp 103 PID 4248 wrote to memory of 1636 4248 3FE7.tmp 103 PID 4248 wrote to memory of 1636 4248 3FE7.tmp 103 PID 1636 wrote to memory of 5056 1636 4035.tmp 104 PID 1636 wrote to memory of 5056 1636 4035.tmp 104 PID 1636 wrote to memory of 5056 1636 4035.tmp 104 PID 5056 wrote to memory of 4704 5056 4093.tmp 105 PID 5056 wrote to memory of 4704 5056 4093.tmp 105 PID 5056 wrote to memory of 4704 5056 4093.tmp 105 PID 4704 wrote to memory of 2356 4704 40E1.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_731765af2acf6cba9c0d00f19b94d029_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"23⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"24⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"25⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"26⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"27⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"28⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"29⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"30⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"31⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"32⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"33⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"34⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"35⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"36⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"37⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"38⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"39⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"40⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"41⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"42⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"43⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"44⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"45⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"46⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"47⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"48⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"49⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"50⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"51⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"52⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"53⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"54⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"55⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"56⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"57⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"58⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"59⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"60⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"61⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"62⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"63⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"64⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"65⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"67⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"68⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"69⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"70⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"71⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"72⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"73⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"75⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"76⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"77⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"78⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"79⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"80⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"81⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"82⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"83⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"84⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"85⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"86⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"87⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"88⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"89⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"90⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"91⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"92⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"93⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"94⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"95⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"96⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"97⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"98⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"99⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"100⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"101⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"102⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"103⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"104⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"105⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"106⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"107⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"108⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"109⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"110⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"111⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"112⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"113⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"114⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"115⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"116⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"117⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"118⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"119⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"120⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"121⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"122⤵PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-