Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe
-
Size
487KB
-
MD5
100fb05c0f74083df648f2a2f0df33c5
-
SHA1
3210b602666e031f0518ef620b396f2ded3b5c35
-
SHA256
bc5b06384098a8385f1edec9ee0b2e26e4c7d91a7976c639afa70881b13a1ec5
-
SHA512
d0fca2006ad01712a852f99ed6bb03419d96a396967d4354ef9e3664ce935e3c187a0906dd25142b2506f82e4ea4997d3daa0608d800af0fa8f7b148b300f423
-
SSDEEP
12288:HU5rCOTeiJm3TiG7/drz6/AxXnkKw++7BVoNZ:HUQOJJb/eH+7B+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2920 4045.tmp 3636 40C2.tmp 3396 415E.tmp 1348 41DB.tmp 1828 4268.tmp 2816 4304.tmp 4568 4381.tmp 1668 43DF.tmp 1748 444C.tmp 2104 449A.tmp 3240 4508.tmp 1032 4556.tmp 908 45B4.tmp 556 4621.tmp 1440 466F.tmp 4296 46FC.tmp 4784 474A.tmp 2028 47C7.tmp 4456 4825.tmp 1584 48A2.tmp 2464 492E.tmp 1368 499C.tmp 1056 4A19.tmp 4292 4A96.tmp 2000 4B22.tmp 2144 4B80.tmp 4852 4BDE.tmp 4988 4C4B.tmp 388 4CC8.tmp 2380 4D26.tmp 4564 4D84.tmp 4092 4DF1.tmp 4404 4E5E.tmp 3204 4EBC.tmp 5048 4F1A.tmp 1420 4F68.tmp 3292 4FB6.tmp 3224 5004.tmp 3272 5062.tmp 4396 50B0.tmp 1052 50FE.tmp 960 515C.tmp 2444 51BA.tmp 3628 5208.tmp 764 5256.tmp 1492 52A4.tmp 4840 5302.tmp 2840 5350.tmp 3604 539E.tmp 2880 53EC.tmp 1904 543A.tmp 1624 5488.tmp 1204 54D7.tmp 2432 5525.tmp 1604 5573.tmp 4248 55C1.tmp 1400 561F.tmp 1248 567C.tmp 544 56DA.tmp 4708 5728.tmp 2460 5776.tmp 1360 57C5.tmp 4784 5822.tmp 4052 5870.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 8 wrote to memory of 2920 8 2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe 82 PID 8 wrote to memory of 2920 8 2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe 82 PID 8 wrote to memory of 2920 8 2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe 82 PID 2920 wrote to memory of 3636 2920 4045.tmp 83 PID 2920 wrote to memory of 3636 2920 4045.tmp 83 PID 2920 wrote to memory of 3636 2920 4045.tmp 83 PID 3636 wrote to memory of 3396 3636 40C2.tmp 84 PID 3636 wrote to memory of 3396 3636 40C2.tmp 84 PID 3636 wrote to memory of 3396 3636 40C2.tmp 84 PID 3396 wrote to memory of 1348 3396 415E.tmp 86 PID 3396 wrote to memory of 1348 3396 415E.tmp 86 PID 3396 wrote to memory of 1348 3396 415E.tmp 86 PID 1348 wrote to memory of 1828 1348 41DB.tmp 87 PID 1348 wrote to memory of 1828 1348 41DB.tmp 87 PID 1348 wrote to memory of 1828 1348 41DB.tmp 87 PID 1828 wrote to memory of 2816 1828 4268.tmp 90 PID 1828 wrote to memory of 2816 1828 4268.tmp 90 PID 1828 wrote to memory of 2816 1828 4268.tmp 90 PID 2816 wrote to memory of 4568 2816 4304.tmp 91 PID 2816 wrote to memory of 4568 2816 4304.tmp 91 PID 2816 wrote to memory of 4568 2816 4304.tmp 91 PID 4568 wrote to memory of 1668 4568 4381.tmp 92 PID 4568 wrote to memory of 1668 4568 4381.tmp 92 PID 4568 wrote to memory of 1668 4568 4381.tmp 92 PID 1668 wrote to memory of 1748 1668 43DF.tmp 93 PID 1668 wrote to memory of 1748 1668 43DF.tmp 93 PID 1668 wrote to memory of 1748 1668 43DF.tmp 93 PID 1748 wrote to memory of 2104 1748 444C.tmp 94 PID 1748 wrote to memory of 2104 1748 444C.tmp 94 PID 1748 wrote to memory of 2104 1748 444C.tmp 94 PID 2104 wrote to memory of 3240 2104 449A.tmp 95 PID 2104 wrote to memory of 3240 2104 449A.tmp 95 PID 2104 wrote to memory of 3240 2104 449A.tmp 95 PID 3240 wrote to memory of 1032 3240 4508.tmp 96 PID 3240 wrote to memory of 1032 3240 4508.tmp 96 PID 3240 wrote to memory of 1032 3240 4508.tmp 96 PID 1032 wrote to memory of 908 1032 4556.tmp 97 PID 1032 wrote to memory of 908 1032 4556.tmp 97 PID 1032 wrote to memory of 908 1032 4556.tmp 97 PID 908 wrote to memory of 556 908 45B4.tmp 98 PID 908 wrote to memory of 556 908 45B4.tmp 98 PID 908 wrote to memory of 556 908 45B4.tmp 98 PID 556 wrote to memory of 1440 556 4621.tmp 99 PID 556 wrote to memory of 1440 556 4621.tmp 99 PID 556 wrote to memory of 1440 556 4621.tmp 99 PID 1440 wrote to memory of 4296 1440 466F.tmp 100 PID 1440 wrote to memory of 4296 1440 466F.tmp 100 PID 1440 wrote to memory of 4296 1440 466F.tmp 100 PID 4296 wrote to memory of 4784 4296 46FC.tmp 101 PID 4296 wrote to memory of 4784 4296 46FC.tmp 101 PID 4296 wrote to memory of 4784 4296 46FC.tmp 101 PID 4784 wrote to memory of 2028 4784 474A.tmp 102 PID 4784 wrote to memory of 2028 4784 474A.tmp 102 PID 4784 wrote to memory of 2028 4784 474A.tmp 102 PID 2028 wrote to memory of 4456 2028 47C7.tmp 103 PID 2028 wrote to memory of 4456 2028 47C7.tmp 103 PID 2028 wrote to memory of 4456 2028 47C7.tmp 103 PID 4456 wrote to memory of 1584 4456 4825.tmp 104 PID 4456 wrote to memory of 1584 4456 4825.tmp 104 PID 4456 wrote to memory of 1584 4456 4825.tmp 104 PID 1584 wrote to memory of 2464 1584 48A2.tmp 105 PID 1584 wrote to memory of 2464 1584 48A2.tmp 105 PID 1584 wrote to memory of 2464 1584 48A2.tmp 105 PID 2464 wrote to memory of 1368 2464 492E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_100fb05c0f74083df648f2a2f0df33c5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"23⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"24⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"25⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"26⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"27⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"28⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"29⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"30⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"31⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"32⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"33⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"34⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"35⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"36⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"37⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"38⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"39⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"40⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"41⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"42⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"43⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"44⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"45⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"46⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"47⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"48⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"49⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"50⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"51⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"52⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"53⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"54⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"55⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"56⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"57⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"58⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"59⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"60⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"61⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"62⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"63⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"64⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"65⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"66⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"67⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"68⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"69⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"70⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"71⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"72⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"73⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"74⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"75⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"76⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"78⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"79⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"80⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"81⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"82⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"83⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"84⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"85⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"86⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"87⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"88⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"89⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"90⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"91⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"92⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"93⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"94⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"95⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"96⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"97⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"98⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"99⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"100⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"101⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"102⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"103⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"104⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"105⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"106⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"107⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"108⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"109⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"110⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"111⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"112⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"113⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"114⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"115⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"116⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"117⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"118⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"119⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"120⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"121⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"122⤵PID:1224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-