Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 18:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe
-
Size
529KB
-
MD5
7aa9b895bc8fd2daa11db4deef7f7a76
-
SHA1
998f6babe0be9b6854fb1f302488028878ca9b00
-
SHA256
85c244df56a028ce21bc7b34de51b29870a111cc9bcc4d17de3e61f666aff51e
-
SHA512
4787943005d30f037bd8c62ed6261876ad14a0a564c263cf3f52b4362e617da6531c3fda82624909d08bf248030e1fb50666f70557fff5b76b83b2f667b88bf3
-
SSDEEP
12288:NU5rCOTeijh0o5lNBr20EboN6WabsA6bATZwlH4Hp:NUQOJj6unBrpP6Wabp6bATSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2160 4016.tmp 2472 40A3.tmp 2800 4100.tmp 2412 417D.tmp 4068 41EB.tmp 2664 4239.tmp 2200 4287.tmp 2108 42D5.tmp 2032 4333.tmp 2760 43A0.tmp 3068 43FE.tmp 4032 447B.tmp 5064 44E8.tmp 2916 4556.tmp 3932 45D3.tmp 3308 4640.tmp 2720 46CD.tmp 1052 472B.tmp 4752 47B7.tmp 3952 4834.tmp 4408 4892.tmp 2236 491F.tmp 4668 497C.tmp 2164 49DA.tmp 2676 4A57.tmp 1488 4AA5.tmp 1156 4B13.tmp 4608 4B61.tmp 5068 4BBE.tmp 1952 4C4B.tmp 3292 4CC8.tmp 2180 4D16.tmp 3016 4D84.tmp 2332 4DD2.tmp 424 4E2F.tmp 1300 4E8D.tmp 3324 4EEB.tmp 4288 4F68.tmp 2224 4FC6.tmp 4584 5014.tmp 2160 5062.tmp 3036 50B0.tmp 536 510E.tmp 3288 515C.tmp 624 51AA.tmp 1200 5208.tmp 2320 5266.tmp 1500 52C3.tmp 3860 5311.tmp 804 537F.tmp 4260 53DD.tmp 2068 543A.tmp 2152 5488.tmp 4280 54E6.tmp 2760 5544.tmp 3792 55A2.tmp 864 55FF.tmp 3548 565D.tmp 2680 56BB.tmp 5116 5719.tmp 3628 5776.tmp 2324 57D4.tmp 2840 5822.tmp 4268 5880.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 2160 3616 2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe 83 PID 3616 wrote to memory of 2160 3616 2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe 83 PID 3616 wrote to memory of 2160 3616 2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe 83 PID 2160 wrote to memory of 2472 2160 4016.tmp 84 PID 2160 wrote to memory of 2472 2160 4016.tmp 84 PID 2160 wrote to memory of 2472 2160 4016.tmp 84 PID 2472 wrote to memory of 2800 2472 40A3.tmp 85 PID 2472 wrote to memory of 2800 2472 40A3.tmp 85 PID 2472 wrote to memory of 2800 2472 40A3.tmp 85 PID 2800 wrote to memory of 2412 2800 4100.tmp 87 PID 2800 wrote to memory of 2412 2800 4100.tmp 87 PID 2800 wrote to memory of 2412 2800 4100.tmp 87 PID 2412 wrote to memory of 4068 2412 417D.tmp 88 PID 2412 wrote to memory of 4068 2412 417D.tmp 88 PID 2412 wrote to memory of 4068 2412 417D.tmp 88 PID 4068 wrote to memory of 2664 4068 41EB.tmp 90 PID 4068 wrote to memory of 2664 4068 41EB.tmp 90 PID 4068 wrote to memory of 2664 4068 41EB.tmp 90 PID 2664 wrote to memory of 2200 2664 4239.tmp 92 PID 2664 wrote to memory of 2200 2664 4239.tmp 92 PID 2664 wrote to memory of 2200 2664 4239.tmp 92 PID 2200 wrote to memory of 2108 2200 4287.tmp 93 PID 2200 wrote to memory of 2108 2200 4287.tmp 93 PID 2200 wrote to memory of 2108 2200 4287.tmp 93 PID 2108 wrote to memory of 2032 2108 42D5.tmp 94 PID 2108 wrote to memory of 2032 2108 42D5.tmp 94 PID 2108 wrote to memory of 2032 2108 42D5.tmp 94 PID 2032 wrote to memory of 2760 2032 4333.tmp 95 PID 2032 wrote to memory of 2760 2032 4333.tmp 95 PID 2032 wrote to memory of 2760 2032 4333.tmp 95 PID 2760 wrote to memory of 3068 2760 43A0.tmp 96 PID 2760 wrote to memory of 3068 2760 43A0.tmp 96 PID 2760 wrote to memory of 3068 2760 43A0.tmp 96 PID 3068 wrote to memory of 4032 3068 43FE.tmp 97 PID 3068 wrote to memory of 4032 3068 43FE.tmp 97 PID 3068 wrote to memory of 4032 3068 43FE.tmp 97 PID 4032 wrote to memory of 5064 4032 447B.tmp 98 PID 4032 wrote to memory of 5064 4032 447B.tmp 98 PID 4032 wrote to memory of 5064 4032 447B.tmp 98 PID 5064 wrote to memory of 2916 5064 44E8.tmp 99 PID 5064 wrote to memory of 2916 5064 44E8.tmp 99 PID 5064 wrote to memory of 2916 5064 44E8.tmp 99 PID 2916 wrote to memory of 3932 2916 4556.tmp 100 PID 2916 wrote to memory of 3932 2916 4556.tmp 100 PID 2916 wrote to memory of 3932 2916 4556.tmp 100 PID 3932 wrote to memory of 3308 3932 45D3.tmp 101 PID 3932 wrote to memory of 3308 3932 45D3.tmp 101 PID 3932 wrote to memory of 3308 3932 45D3.tmp 101 PID 3308 wrote to memory of 2720 3308 4640.tmp 102 PID 3308 wrote to memory of 2720 3308 4640.tmp 102 PID 3308 wrote to memory of 2720 3308 4640.tmp 102 PID 2720 wrote to memory of 1052 2720 46CD.tmp 103 PID 2720 wrote to memory of 1052 2720 46CD.tmp 103 PID 2720 wrote to memory of 1052 2720 46CD.tmp 103 PID 1052 wrote to memory of 4752 1052 472B.tmp 104 PID 1052 wrote to memory of 4752 1052 472B.tmp 104 PID 1052 wrote to memory of 4752 1052 472B.tmp 104 PID 4752 wrote to memory of 3952 4752 47B7.tmp 105 PID 4752 wrote to memory of 3952 4752 47B7.tmp 105 PID 4752 wrote to memory of 3952 4752 47B7.tmp 105 PID 3952 wrote to memory of 4408 3952 4834.tmp 106 PID 3952 wrote to memory of 4408 3952 4834.tmp 106 PID 3952 wrote to memory of 4408 3952 4834.tmp 106 PID 4408 wrote to memory of 2236 4408 4892.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_7aa9b895bc8fd2daa11db4deef7f7a76_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"23⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"24⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"25⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"26⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"27⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"28⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"29⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"30⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"31⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"32⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"33⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"34⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"35⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"36⤵
- Executes dropped EXE
PID:424 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"37⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"38⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"39⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"40⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"41⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"42⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"43⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"44⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"45⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"46⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"47⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"48⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"49⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"50⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"51⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"52⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"53⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"54⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"55⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"56⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"57⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"58⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"59⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"60⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"61⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"62⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"63⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"64⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"65⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"66⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"67⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"68⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"69⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"70⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"71⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"72⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"73⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"74⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"75⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"76⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"77⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"78⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"79⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"80⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"81⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"82⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"83⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"84⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"85⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"86⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"87⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"88⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"89⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"90⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"91⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"92⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"93⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"94⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"95⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"96⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"97⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"98⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"99⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"100⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"101⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"102⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"103⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"104⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"105⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"106⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"108⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"109⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"110⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"111⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"112⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"113⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"114⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"115⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"116⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"117⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"118⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"119⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"120⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"121⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-