Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe
-
Size
536KB
-
MD5
2a794fe5e272c5b1c5bdea8e899915f7
-
SHA1
06cf1931317253c2c39f5f3c462f510fc5fcda37
-
SHA256
542f19eb0692a949536306d7ee1d1c74fe0b0c686daa10aab630decc201d4afd
-
SHA512
b23142624e921cff47a42e490d3e154b6a0f112400174f27652c9ff2f719f454575fc5464c69d366d2eb053d29f907919c990f787161cf3b858aee72ff379bd3
-
SSDEEP
12288:wU5rCOTeiUID/RZOAdGj2tFlCJ38GDAnIZxVJ0ZT9:wUQOJUIFZOvj2vlCJ38DIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2356 351A.tmp 3796 3577.tmp 1708 35C5.tmp 4696 36CF.tmp 4960 371D.tmp 4264 37B9.tmp 2272 3817.tmp 4840 39DC.tmp 1336 3A3A.tmp 1084 3AB7.tmp 556 3B05.tmp 4612 3B63.tmp 2228 3BF0.tmp 3184 3CAB.tmp 3004 3D28.tmp 4704 3D86.tmp 4456 3DE4.tmp 2140 3ECE.tmp 1608 3F1C.tmp 4292 3F6A.tmp 4396 4016.tmp 5052 4074.tmp 2880 414F.tmp 4056 420A.tmp 1068 4258.tmp 1344 42D5.tmp 4368 4333.tmp 536 4391.tmp 2260 43FE.tmp 3760 446B.tmp 4976 44C9.tmp 1612 4537.tmp 4564 4594.tmp 3624 45F2.tmp 4960 4640.tmp 3476 46AE.tmp 4208 471B.tmp 4964 4798.tmp 2780 47F6.tmp 4592 4844.tmp 4916 48A2.tmp 3192 48FF.tmp 1800 495D.tmp 2192 49BB.tmp 4340 4A09.tmp 4716 4A57.tmp 3268 4AC4.tmp 996 4B13.tmp 2768 4B61.tmp 3196 4BAF.tmp 3116 4BFD.tmp 4056 4C4B.tmp 3860 4CA9.tmp 2960 4CF7.tmp 4380 4D45.tmp 4760 4D93.tmp 936 4E2F.tmp 3960 4E8D.tmp 316 4EDB.tmp 1368 4F29.tmp 2616 4F78.tmp 1220 4FC6.tmp 924 5014.tmp 2504 5062.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2356 2072 2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe 594 PID 2072 wrote to memory of 2356 2072 2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe 594 PID 2072 wrote to memory of 2356 2072 2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe 594 PID 2356 wrote to memory of 3796 2356 351A.tmp 85 PID 2356 wrote to memory of 3796 2356 351A.tmp 85 PID 2356 wrote to memory of 3796 2356 351A.tmp 85 PID 3796 wrote to memory of 1708 3796 3577.tmp 86 PID 3796 wrote to memory of 1708 3796 3577.tmp 86 PID 3796 wrote to memory of 1708 3796 3577.tmp 86 PID 1708 wrote to memory of 4696 1708 35C5.tmp 87 PID 1708 wrote to memory of 4696 1708 35C5.tmp 87 PID 1708 wrote to memory of 4696 1708 35C5.tmp 87 PID 4696 wrote to memory of 4960 4696 36CF.tmp 229 PID 4696 wrote to memory of 4960 4696 36CF.tmp 229 PID 4696 wrote to memory of 4960 4696 36CF.tmp 229 PID 4960 wrote to memory of 4264 4960 371D.tmp 91 PID 4960 wrote to memory of 4264 4960 371D.tmp 91 PID 4960 wrote to memory of 4264 4960 371D.tmp 91 PID 4264 wrote to memory of 2272 4264 37B9.tmp 92 PID 4264 wrote to memory of 2272 4264 37B9.tmp 92 PID 4264 wrote to memory of 2272 4264 37B9.tmp 92 PID 2272 wrote to memory of 4840 2272 3817.tmp 93 PID 2272 wrote to memory of 4840 2272 3817.tmp 93 PID 2272 wrote to memory of 4840 2272 3817.tmp 93 PID 4840 wrote to memory of 1336 4840 39DC.tmp 94 PID 4840 wrote to memory of 1336 4840 39DC.tmp 94 PID 4840 wrote to memory of 1336 4840 39DC.tmp 94 PID 1336 wrote to memory of 1084 1336 3A3A.tmp 95 PID 1336 wrote to memory of 1084 1336 3A3A.tmp 95 PID 1336 wrote to memory of 1084 1336 3A3A.tmp 95 PID 1084 wrote to memory of 556 1084 3AB7.tmp 407 PID 1084 wrote to memory of 556 1084 3AB7.tmp 407 PID 1084 wrote to memory of 556 1084 3AB7.tmp 407 PID 556 wrote to memory of 4612 556 3B05.tmp 204 PID 556 wrote to memory of 4612 556 3B05.tmp 204 PID 556 wrote to memory of 4612 556 3B05.tmp 204 PID 4612 wrote to memory of 2228 4612 3B63.tmp 270 PID 4612 wrote to memory of 2228 4612 3B63.tmp 270 PID 4612 wrote to memory of 2228 4612 3B63.tmp 270 PID 2228 wrote to memory of 3184 2228 3BF0.tmp 356 PID 2228 wrote to memory of 3184 2228 3BF0.tmp 356 PID 2228 wrote to memory of 3184 2228 3BF0.tmp 356 PID 3184 wrote to memory of 3004 3184 3CAB.tmp 539 PID 3184 wrote to memory of 3004 3184 3CAB.tmp 539 PID 3184 wrote to memory of 3004 3184 3CAB.tmp 539 PID 3004 wrote to memory of 4704 3004 3D28.tmp 101 PID 3004 wrote to memory of 4704 3004 3D28.tmp 101 PID 3004 wrote to memory of 4704 3004 3D28.tmp 101 PID 4704 wrote to memory of 4456 4704 3D86.tmp 102 PID 4704 wrote to memory of 4456 4704 3D86.tmp 102 PID 4704 wrote to memory of 4456 4704 3D86.tmp 102 PID 4456 wrote to memory of 2140 4456 3DE4.tmp 103 PID 4456 wrote to memory of 2140 4456 3DE4.tmp 103 PID 4456 wrote to memory of 2140 4456 3DE4.tmp 103 PID 2140 wrote to memory of 1608 2140 3ECE.tmp 104 PID 2140 wrote to memory of 1608 2140 3ECE.tmp 104 PID 2140 wrote to memory of 1608 2140 3ECE.tmp 104 PID 1608 wrote to memory of 4292 1608 3F1C.tmp 417 PID 1608 wrote to memory of 4292 1608 3F1C.tmp 417 PID 1608 wrote to memory of 4292 1608 3F1C.tmp 417 PID 4292 wrote to memory of 4396 4292 3F6A.tmp 106 PID 4292 wrote to memory of 4396 4292 3F6A.tmp 106 PID 4292 wrote to memory of 4396 4292 3F6A.tmp 106 PID 4396 wrote to memory of 5052 4396 4016.tmp 373
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_2a794fe5e272c5b1c5bdea8e899915f7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\35C5.tmp"C:\Users\Admin\AppData\Local\Temp\35C5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"23⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"24⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"25⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"26⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"27⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"28⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"29⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"30⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"31⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"32⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"33⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"34⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"35⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"36⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"37⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"38⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"39⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"40⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"41⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"42⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"43⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"44⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"45⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"46⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"47⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"48⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"49⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"50⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"51⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"52⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"53⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"55⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"56⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"57⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"58⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"59⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"60⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"61⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"62⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"63⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"64⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"65⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"66⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"67⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"68⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"69⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"70⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"71⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"72⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"73⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"74⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"75⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"76⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"77⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"78⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"79⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"80⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"81⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"82⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"83⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"84⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"85⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"86⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"87⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"88⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"89⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"90⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"91⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"92⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"93⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"94⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"95⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"96⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"97⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"98⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"99⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"101⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"102⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"103⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"104⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"105⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"106⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"107⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"108⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"109⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"110⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"111⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"112⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"113⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"114⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"115⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"116⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"117⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"118⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"119⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"120⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"121⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-