Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
-
Size
541KB
-
MD5
64ee48fbefe93907ff6d54c080c4d12e
-
SHA1
8bbdb4e049a8b51960ec1c32c90733b7a0d74ec6
-
SHA256
4ed1daec6265ef7467c4e45c2fd2cc9ce7bca9bfcf22e1619ec76bd612fe6798
-
SHA512
214e7bc9d00c70a0d13e08c3f8e520cffbfb48e44d148d3778cba770045628ad8351bd563027fbe2ca7d6200f7466568f67f55b05b2963c0bf15272034174bf8
-
SSDEEP
12288:UU5rCOTeifVUzhSo9gNwD2RCrZa73ctO:UUQOJfVgh77KRCrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2736 3827.tmp 2288 38A4.tmp 2904 3902.tmp 1868 396F.tmp 644 39CD.tmp 2504 3A3A.tmp 1476 3A98.tmp 5424 3AF6.tmp 976 3B44.tmp 4600 3BB1.tmp 5024 3C1E.tmp 3952 3C6D.tmp 4080 3CCA.tmp 6088 3D38.tmp 5092 3D86.tmp 4136 3E12.tmp 3716 3E80.tmp 4056 3ECE.tmp 5168 3F3B.tmp 5720 3FB8.tmp 1256 4026.tmp 5420 4093.tmp 3436 40F1.tmp 5284 415E.tmp 3660 41CC.tmp 5748 421A.tmp 4156 4277.tmp 4124 42E5.tmp 4884 4352.tmp 1460 43B0.tmp 1576 43FE.tmp 1484 444C.tmp 408 449A.tmp 1488 44E8.tmp 1976 4537.tmp 2568 4594.tmp 5272 45E2.tmp 5444 4631.tmp 5680 467F.tmp 3396 470B.tmp 3020 4759.tmp 2624 47B7.tmp 4380 4805.tmp 1160 4863.tmp 4788 48B1.tmp 4588 490F.tmp 2928 495D.tmp 5292 49AB.tmp 2708 4A09.tmp 1504 4A57.tmp 3416 4AA5.tmp 3596 4AF3.tmp 3024 4B51.tmp 5512 4BBE.tmp 2388 4C1C.tmp 6040 4C8A.tmp 5776 4CD8.tmp 2828 4D35.tmp 1824 4D93.tmp 5688 4DE1.tmp 1512 4E2F.tmp 5956 4E7E.tmp 4632 4EDB.tmp 1240 4F39.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 2736 4908 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 82 PID 4908 wrote to memory of 2736 4908 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 82 PID 4908 wrote to memory of 2736 4908 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 82 PID 2736 wrote to memory of 2288 2736 3827.tmp 83 PID 2736 wrote to memory of 2288 2736 3827.tmp 83 PID 2736 wrote to memory of 2288 2736 3827.tmp 83 PID 2288 wrote to memory of 2904 2288 38A4.tmp 84 PID 2288 wrote to memory of 2904 2288 38A4.tmp 84 PID 2288 wrote to memory of 2904 2288 38A4.tmp 84 PID 2904 wrote to memory of 1868 2904 3902.tmp 85 PID 2904 wrote to memory of 1868 2904 3902.tmp 85 PID 2904 wrote to memory of 1868 2904 3902.tmp 85 PID 1868 wrote to memory of 644 1868 396F.tmp 87 PID 1868 wrote to memory of 644 1868 396F.tmp 87 PID 1868 wrote to memory of 644 1868 396F.tmp 87 PID 644 wrote to memory of 2504 644 39CD.tmp 89 PID 644 wrote to memory of 2504 644 39CD.tmp 89 PID 644 wrote to memory of 2504 644 39CD.tmp 89 PID 2504 wrote to memory of 1476 2504 3A3A.tmp 91 PID 2504 wrote to memory of 1476 2504 3A3A.tmp 91 PID 2504 wrote to memory of 1476 2504 3A3A.tmp 91 PID 1476 wrote to memory of 5424 1476 3A98.tmp 92 PID 1476 wrote to memory of 5424 1476 3A98.tmp 92 PID 1476 wrote to memory of 5424 1476 3A98.tmp 92 PID 5424 wrote to memory of 976 5424 3AF6.tmp 93 PID 5424 wrote to memory of 976 5424 3AF6.tmp 93 PID 5424 wrote to memory of 976 5424 3AF6.tmp 93 PID 976 wrote to memory of 4600 976 3B44.tmp 94 PID 976 wrote to memory of 4600 976 3B44.tmp 94 PID 976 wrote to memory of 4600 976 3B44.tmp 94 PID 4600 wrote to memory of 5024 4600 3BB1.tmp 95 PID 4600 wrote to memory of 5024 4600 3BB1.tmp 95 PID 4600 wrote to memory of 5024 4600 3BB1.tmp 95 PID 5024 wrote to memory of 3952 5024 3C1E.tmp 96 PID 5024 wrote to memory of 3952 5024 3C1E.tmp 96 PID 5024 wrote to memory of 3952 5024 3C1E.tmp 96 PID 3952 wrote to memory of 4080 3952 3C6D.tmp 97 PID 3952 wrote to memory of 4080 3952 3C6D.tmp 97 PID 3952 wrote to memory of 4080 3952 3C6D.tmp 97 PID 4080 wrote to memory of 6088 4080 3CCA.tmp 98 PID 4080 wrote to memory of 6088 4080 3CCA.tmp 98 PID 4080 wrote to memory of 6088 4080 3CCA.tmp 98 PID 6088 wrote to memory of 5092 6088 3D38.tmp 99 PID 6088 wrote to memory of 5092 6088 3D38.tmp 99 PID 6088 wrote to memory of 5092 6088 3D38.tmp 99 PID 5092 wrote to memory of 4136 5092 3D86.tmp 100 PID 5092 wrote to memory of 4136 5092 3D86.tmp 100 PID 5092 wrote to memory of 4136 5092 3D86.tmp 100 PID 4136 wrote to memory of 3716 4136 3E12.tmp 101 PID 4136 wrote to memory of 3716 4136 3E12.tmp 101 PID 4136 wrote to memory of 3716 4136 3E12.tmp 101 PID 3716 wrote to memory of 4056 3716 3E80.tmp 102 PID 3716 wrote to memory of 4056 3716 3E80.tmp 102 PID 3716 wrote to memory of 4056 3716 3E80.tmp 102 PID 4056 wrote to memory of 5168 4056 3ECE.tmp 103 PID 4056 wrote to memory of 5168 4056 3ECE.tmp 103 PID 4056 wrote to memory of 5168 4056 3ECE.tmp 103 PID 5168 wrote to memory of 5720 5168 3F3B.tmp 104 PID 5168 wrote to memory of 5720 5168 3F3B.tmp 104 PID 5168 wrote to memory of 5720 5168 3F3B.tmp 104 PID 5720 wrote to memory of 1256 5720 3FB8.tmp 105 PID 5720 wrote to memory of 1256 5720 3FB8.tmp 105 PID 5720 wrote to memory of 1256 5720 3FB8.tmp 105 PID 1256 wrote to memory of 5420 1256 4026.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"23⤵
- Executes dropped EXE
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"24⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"25⤵
- Executes dropped EXE
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"26⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"27⤵
- Executes dropped EXE
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"28⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"29⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"30⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"31⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"32⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"33⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"34⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"35⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"36⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"37⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"38⤵
- Executes dropped EXE
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"39⤵
- Executes dropped EXE
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"40⤵
- Executes dropped EXE
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"41⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"42⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"43⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"44⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"45⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"46⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"47⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"48⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"49⤵
- Executes dropped EXE
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"50⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"51⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"52⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"53⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"54⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"55⤵
- Executes dropped EXE
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"56⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"57⤵
- Executes dropped EXE
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"58⤵
- Executes dropped EXE
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"59⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"60⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"61⤵
- Executes dropped EXE
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"62⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"63⤵
- Executes dropped EXE
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"64⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"65⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"66⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"67⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"68⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"69⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"70⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"71⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"72⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"73⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"74⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"75⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"76⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"77⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"78⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"79⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"80⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"81⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"82⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"83⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"84⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"85⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"86⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"87⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"88⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"89⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"90⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"91⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"92⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"93⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"94⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"96⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"97⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"98⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"99⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"100⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"101⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"102⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"103⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"104⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"105⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"106⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"107⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"108⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"109⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"110⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"111⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"112⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"113⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"114⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"115⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"116⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"117⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"118⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"119⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"120⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"121⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"122⤵PID:3912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-