Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe
-
Size
541KB
-
MD5
ce0509449b4d5c333170875700910511
-
SHA1
aea3f3052dda44e844680d21a99b82b531c003e0
-
SHA256
aff7cbb9f06bbd667c0b94877d2bf59e8a301de02edb3d021574117e4da87db2
-
SHA512
ed6713a144c112e8404ee1d83b0f10c9298faa543e74ff3d16dd87eebe705036a491f1af47e3bf29a15c634690e5fcba4ff914cd865f990c3d8b061b1ea26c8e
-
SSDEEP
12288:UU5rCOTeifGeRR+Ekm//J27Yw6rZa73ctO:UUQOJfy3wJ2erU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
445C.tmp4527.tmp45B4.tmp4621.tmp468E.tmp472B.tmp47D6.tmp4853.tmp48E0.tmp495D.tmp49CA.tmp4A38.tmp4AB5.tmp4B13.tmp4B70.tmp4BDE.tmp4C7A.tmp4CE7.tmp4D55.tmp4DE1.tmp4E5E.tmp4EBC.tmp4F29.tmp4F78.tmp4FD5.tmp5033.tmp50A0.tmp510E.tmp519A.tmp5217.tmp5294.tmp5311.tmp536F.tmp53CD.tmp541B.tmp5469.tmp54C7.tmp5515.tmp5573.tmp55C1.tmp561F.tmp566D.tmp56BB.tmp5719.tmp5767.tmp57B5.tmp5813.tmp5861.tmp58BF.tmp590D.tmp595B.tmp59B9.tmp5A16.tmp5A64.tmp5AC2.tmp5B20.tmp5B6E.tmp5BCC.tmp5C2A.tmp5C87.tmp5CE5.tmp5D43.tmp5D91.tmp5DEF.tmppid process 3964 445C.tmp 3448 4527.tmp 964 45B4.tmp 4328 4621.tmp 2480 468E.tmp 1924 472B.tmp 2076 47D6.tmp 2092 4853.tmp 1200 48E0.tmp 2216 495D.tmp 3812 49CA.tmp 5076 4A38.tmp 840 4AB5.tmp 3112 4B13.tmp 4304 4B70.tmp 2828 4BDE.tmp 3228 4C7A.tmp 1720 4CE7.tmp 2100 4D55.tmp 3252 4DE1.tmp 2004 4E5E.tmp 880 4EBC.tmp 804 4F29.tmp 5112 4F78.tmp 4076 4FD5.tmp 400 5033.tmp 1780 50A0.tmp 1612 510E.tmp 4088 519A.tmp 3216 5217.tmp 3376 5294.tmp 3828 5311.tmp 4628 536F.tmp 4064 53CD.tmp 4976 541B.tmp 3320 5469.tmp 2572 54C7.tmp 1292 5515.tmp 224 5573.tmp 4364 55C1.tmp 1564 561F.tmp 1208 566D.tmp 4588 56BB.tmp 2936 5719.tmp 3380 5767.tmp 2360 57B5.tmp 552 5813.tmp 2988 5861.tmp 1988 58BF.tmp 4984 590D.tmp 4900 595B.tmp 2448 59B9.tmp 5076 5A16.tmp 2836 5A64.tmp 1040 5AC2.tmp 4472 5B20.tmp 5024 5B6E.tmp 2308 5BCC.tmp 4940 5C2A.tmp 3232 5C87.tmp 1720 5CE5.tmp 4052 5D43.tmp 1080 5D91.tmp 4184 5DEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe445C.tmp4527.tmp45B4.tmp4621.tmp468E.tmp472B.tmp47D6.tmp4853.tmp48E0.tmp495D.tmp49CA.tmp4A38.tmp4AB5.tmp4B13.tmp4B70.tmp4BDE.tmp4C7A.tmp4CE7.tmp4D55.tmp4DE1.tmp4E5E.tmpdescription pid process target process PID 5032 wrote to memory of 3964 5032 2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe 445C.tmp PID 5032 wrote to memory of 3964 5032 2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe 445C.tmp PID 5032 wrote to memory of 3964 5032 2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe 445C.tmp PID 3964 wrote to memory of 3448 3964 445C.tmp 4527.tmp PID 3964 wrote to memory of 3448 3964 445C.tmp 4527.tmp PID 3964 wrote to memory of 3448 3964 445C.tmp 4527.tmp PID 3448 wrote to memory of 964 3448 4527.tmp 45B4.tmp PID 3448 wrote to memory of 964 3448 4527.tmp 45B4.tmp PID 3448 wrote to memory of 964 3448 4527.tmp 45B4.tmp PID 964 wrote to memory of 4328 964 45B4.tmp 4621.tmp PID 964 wrote to memory of 4328 964 45B4.tmp 4621.tmp PID 964 wrote to memory of 4328 964 45B4.tmp 4621.tmp PID 4328 wrote to memory of 2480 4328 4621.tmp 468E.tmp PID 4328 wrote to memory of 2480 4328 4621.tmp 468E.tmp PID 4328 wrote to memory of 2480 4328 4621.tmp 468E.tmp PID 2480 wrote to memory of 1924 2480 468E.tmp 472B.tmp PID 2480 wrote to memory of 1924 2480 468E.tmp 472B.tmp PID 2480 wrote to memory of 1924 2480 468E.tmp 472B.tmp PID 1924 wrote to memory of 2076 1924 472B.tmp 47D6.tmp PID 1924 wrote to memory of 2076 1924 472B.tmp 47D6.tmp PID 1924 wrote to memory of 2076 1924 472B.tmp 47D6.tmp PID 2076 wrote to memory of 2092 2076 47D6.tmp 4853.tmp PID 2076 wrote to memory of 2092 2076 47D6.tmp 4853.tmp PID 2076 wrote to memory of 2092 2076 47D6.tmp 4853.tmp PID 2092 wrote to memory of 1200 2092 4853.tmp 48E0.tmp PID 2092 wrote to memory of 1200 2092 4853.tmp 48E0.tmp PID 2092 wrote to memory of 1200 2092 4853.tmp 48E0.tmp PID 1200 wrote to memory of 2216 1200 48E0.tmp 495D.tmp PID 1200 wrote to memory of 2216 1200 48E0.tmp 495D.tmp PID 1200 wrote to memory of 2216 1200 48E0.tmp 495D.tmp PID 2216 wrote to memory of 3812 2216 495D.tmp 49CA.tmp PID 2216 wrote to memory of 3812 2216 495D.tmp 49CA.tmp PID 2216 wrote to memory of 3812 2216 495D.tmp 49CA.tmp PID 3812 wrote to memory of 5076 3812 49CA.tmp 4A38.tmp PID 3812 wrote to memory of 5076 3812 49CA.tmp 4A38.tmp PID 3812 wrote to memory of 5076 3812 49CA.tmp 4A38.tmp PID 5076 wrote to memory of 840 5076 4A38.tmp 4AB5.tmp PID 5076 wrote to memory of 840 5076 4A38.tmp 4AB5.tmp PID 5076 wrote to memory of 840 5076 4A38.tmp 4AB5.tmp PID 840 wrote to memory of 3112 840 4AB5.tmp 4B13.tmp PID 840 wrote to memory of 3112 840 4AB5.tmp 4B13.tmp PID 840 wrote to memory of 3112 840 4AB5.tmp 4B13.tmp PID 3112 wrote to memory of 4304 3112 4B13.tmp 4B70.tmp PID 3112 wrote to memory of 4304 3112 4B13.tmp 4B70.tmp PID 3112 wrote to memory of 4304 3112 4B13.tmp 4B70.tmp PID 4304 wrote to memory of 2828 4304 4B70.tmp 4BDE.tmp PID 4304 wrote to memory of 2828 4304 4B70.tmp 4BDE.tmp PID 4304 wrote to memory of 2828 4304 4B70.tmp 4BDE.tmp PID 2828 wrote to memory of 3228 2828 4BDE.tmp 4C7A.tmp PID 2828 wrote to memory of 3228 2828 4BDE.tmp 4C7A.tmp PID 2828 wrote to memory of 3228 2828 4BDE.tmp 4C7A.tmp PID 3228 wrote to memory of 1720 3228 4C7A.tmp 4CE7.tmp PID 3228 wrote to memory of 1720 3228 4C7A.tmp 4CE7.tmp PID 3228 wrote to memory of 1720 3228 4C7A.tmp 4CE7.tmp PID 1720 wrote to memory of 2100 1720 4CE7.tmp 4D55.tmp PID 1720 wrote to memory of 2100 1720 4CE7.tmp 4D55.tmp PID 1720 wrote to memory of 2100 1720 4CE7.tmp 4D55.tmp PID 2100 wrote to memory of 3252 2100 4D55.tmp 4DE1.tmp PID 2100 wrote to memory of 3252 2100 4D55.tmp 4DE1.tmp PID 2100 wrote to memory of 3252 2100 4D55.tmp 4DE1.tmp PID 3252 wrote to memory of 2004 3252 4DE1.tmp 4E5E.tmp PID 3252 wrote to memory of 2004 3252 4DE1.tmp 4E5E.tmp PID 3252 wrote to memory of 2004 3252 4DE1.tmp 4E5E.tmp PID 2004 wrote to memory of 880 2004 4E5E.tmp 4EBC.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ce0509449b4d5c333170875700910511_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"23⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"24⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"25⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"26⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"27⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"28⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"29⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"30⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"31⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"32⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"33⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"34⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"35⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"36⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"37⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"38⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"39⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"40⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"41⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"42⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"43⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"44⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"45⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"46⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"47⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"48⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"49⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"50⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"51⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"52⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"53⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"54⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"55⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"56⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"57⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"58⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"59⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"60⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"61⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"62⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"63⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"64⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"65⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"66⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"67⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"68⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"69⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"70⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"71⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"72⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"74⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"75⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"76⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"77⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"78⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"79⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"80⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"81⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"82⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"83⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"84⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"85⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"87⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"88⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"89⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"90⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"91⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"92⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"93⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"94⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"95⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"96⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"97⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"98⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"99⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"100⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"101⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"103⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"105⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"106⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"107⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"108⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"109⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"110⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"111⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"112⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"113⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"114⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"115⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"116⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"117⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"118⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"119⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"120⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"121⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-