Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe
-
Size
765KB
-
MD5
51a3b8b485db07c91cc68cebbfb7531a
-
SHA1
19682babd5ec0c1a2ff5f39fdb38e3c17660f2e8
-
SHA256
2d46e80feac7958faa3447a9f4924ea931b3a4498ab69440b703cb0ef37afacf
-
SHA512
3b2a1f164e7876adf367b87fa6472c6d10ac2f1fe94b034feecc349cde7506d0fd7bf796fa4a4e7fedcfa7f5c5e7edc15c9b58635b257d6039c2487788042a6f
-
SSDEEP
12288:ZU5rCOTeiDizZ89BiTUcYx7uOetcxdVpBIkbPC3ZF5rn5rLOa54U5w5A:ZUQOJDVKTYx72Ox7IkLC3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3264 346E.tmp 5004 34DB.tmp 4652 3558.tmp 3624 35D5.tmp 1220 3662.tmp 2756 36CF.tmp 2272 374C.tmp 2840 37AA.tmp 2764 37F8.tmp 3076 3856.tmp 556 3A1B.tmp 116 3A88.tmp 1328 3AE6.tmp 1760 3B34.tmp 2876 3BA1.tmp 3676 3C0F.tmp 1468 3C6D.tmp 60 3CCA.tmp 4248 3D57.tmp 4316 3DD4.tmp 3180 3E51.tmp 2944 3EAF.tmp 3936 3F0C.tmp 1580 3F5B.tmp 2276 3FB8.tmp 2656 4026.tmp 2636 4083.tmp 2804 40E1.tmp 5084 412F.tmp 2308 417D.tmp 4676 41EB.tmp 4620 4249.tmp 536 42B6.tmp 4040 4323.tmp 2068 4391.tmp 4520 440E.tmp 2260 445C.tmp 3868 44AA.tmp 3232 44F8.tmp 1224 4546.tmp 2072 4594.tmp 3536 45E2.tmp 3076 4640.tmp 4400 469E.tmp 5032 46FC.tmp 4664 474A.tmp 1080 47A8.tmp 1760 47F6.tmp 3184 4853.tmp 216 48B1.tmp 4472 48FF.tmp 2176 495D.tmp 3996 49AB.tmp 3756 49F9.tmp 4248 4A57.tmp 1428 4AB5.tmp 2396 4B03.tmp 4292 4B61.tmp 2944 4BAF.tmp 1124 4C0D.tmp 4480 4C6A.tmp 1580 4CB8.tmp 1160 4D16.tmp 2244 4D74.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3264 1692 2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe 82 PID 1692 wrote to memory of 3264 1692 2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe 82 PID 1692 wrote to memory of 3264 1692 2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe 82 PID 3264 wrote to memory of 5004 3264 346E.tmp 85 PID 3264 wrote to memory of 5004 3264 346E.tmp 85 PID 3264 wrote to memory of 5004 3264 346E.tmp 85 PID 5004 wrote to memory of 4652 5004 34DB.tmp 86 PID 5004 wrote to memory of 4652 5004 34DB.tmp 86 PID 5004 wrote to memory of 4652 5004 34DB.tmp 86 PID 4652 wrote to memory of 3624 4652 3558.tmp 87 PID 4652 wrote to memory of 3624 4652 3558.tmp 87 PID 4652 wrote to memory of 3624 4652 3558.tmp 87 PID 3624 wrote to memory of 1220 3624 35D5.tmp 90 PID 3624 wrote to memory of 1220 3624 35D5.tmp 90 PID 3624 wrote to memory of 1220 3624 35D5.tmp 90 PID 1220 wrote to memory of 2756 1220 3662.tmp 91 PID 1220 wrote to memory of 2756 1220 3662.tmp 91 PID 1220 wrote to memory of 2756 1220 3662.tmp 91 PID 2756 wrote to memory of 2272 2756 36CF.tmp 92 PID 2756 wrote to memory of 2272 2756 36CF.tmp 92 PID 2756 wrote to memory of 2272 2756 36CF.tmp 92 PID 2272 wrote to memory of 2840 2272 374C.tmp 93 PID 2272 wrote to memory of 2840 2272 374C.tmp 93 PID 2272 wrote to memory of 2840 2272 374C.tmp 93 PID 2840 wrote to memory of 2764 2840 37AA.tmp 94 PID 2840 wrote to memory of 2764 2840 37AA.tmp 94 PID 2840 wrote to memory of 2764 2840 37AA.tmp 94 PID 2764 wrote to memory of 3076 2764 37F8.tmp 95 PID 2764 wrote to memory of 3076 2764 37F8.tmp 95 PID 2764 wrote to memory of 3076 2764 37F8.tmp 95 PID 3076 wrote to memory of 556 3076 3856.tmp 97 PID 3076 wrote to memory of 556 3076 3856.tmp 97 PID 3076 wrote to memory of 556 3076 3856.tmp 97 PID 556 wrote to memory of 116 556 3A1B.tmp 98 PID 556 wrote to memory of 116 556 3A1B.tmp 98 PID 556 wrote to memory of 116 556 3A1B.tmp 98 PID 116 wrote to memory of 1328 116 3A88.tmp 99 PID 116 wrote to memory of 1328 116 3A88.tmp 99 PID 116 wrote to memory of 1328 116 3A88.tmp 99 PID 1328 wrote to memory of 1760 1328 3AE6.tmp 100 PID 1328 wrote to memory of 1760 1328 3AE6.tmp 100 PID 1328 wrote to memory of 1760 1328 3AE6.tmp 100 PID 1760 wrote to memory of 2876 1760 3B34.tmp 101 PID 1760 wrote to memory of 2876 1760 3B34.tmp 101 PID 1760 wrote to memory of 2876 1760 3B34.tmp 101 PID 2876 wrote to memory of 3676 2876 3BA1.tmp 102 PID 2876 wrote to memory of 3676 2876 3BA1.tmp 102 PID 2876 wrote to memory of 3676 2876 3BA1.tmp 102 PID 3676 wrote to memory of 1468 3676 3C0F.tmp 103 PID 3676 wrote to memory of 1468 3676 3C0F.tmp 103 PID 3676 wrote to memory of 1468 3676 3C0F.tmp 103 PID 1468 wrote to memory of 60 1468 3C6D.tmp 104 PID 1468 wrote to memory of 60 1468 3C6D.tmp 104 PID 1468 wrote to memory of 60 1468 3C6D.tmp 104 PID 60 wrote to memory of 4248 60 3CCA.tmp 105 PID 60 wrote to memory of 4248 60 3CCA.tmp 105 PID 60 wrote to memory of 4248 60 3CCA.tmp 105 PID 4248 wrote to memory of 4316 4248 3D57.tmp 106 PID 4248 wrote to memory of 4316 4248 3D57.tmp 106 PID 4248 wrote to memory of 4316 4248 3D57.tmp 106 PID 4316 wrote to memory of 3180 4316 3DD4.tmp 107 PID 4316 wrote to memory of 3180 4316 3DD4.tmp 107 PID 4316 wrote to memory of 3180 4316 3DD4.tmp 107 PID 3180 wrote to memory of 2944 3180 3E51.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_51a3b8b485db07c91cc68cebbfb7531a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\346E.tmp"C:\Users\Admin\AppData\Local\Temp\346E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"23⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"24⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"25⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"26⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"27⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"28⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"29⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"30⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"31⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"32⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"33⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"34⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"35⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"36⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"37⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"38⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"39⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"40⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"41⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"42⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"43⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"44⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"45⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"47⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"48⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"49⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"50⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"51⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"53⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"54⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"55⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"56⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"57⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"58⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"59⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"60⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"61⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"62⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"63⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"64⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"65⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"66⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"67⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"68⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"69⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"70⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"71⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"72⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"73⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"74⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"75⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"76⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"77⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"78⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"79⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"80⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"81⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"82⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"83⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"84⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"85⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"86⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"87⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"88⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"89⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"90⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"91⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"92⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"94⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"95⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"96⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"97⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"98⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"99⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"100⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"101⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"102⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"103⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"104⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"106⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"107⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"108⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"109⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"110⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"111⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"112⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"113⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"114⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"115⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"116⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"117⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"118⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"119⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"120⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"121⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"122⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-