Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
-
Size
530KB
-
MD5
a5e61ed4068c6df2aac275d2b3f60e7b
-
SHA1
a8325e365e9f3763007be932ecc40ef8d75f98a6
-
SHA256
d4b5d1e511657528b1afef59aa2acdfd01d3c1c6434d9f965ca59905afaef450
-
SHA512
074c8816b81e95f352c127ecc34f783d128eaba3543f8a184721e9d55f76d9ad7e80e745f8d10568f0208aab429be26e15ea9df0d1442c43a4f2a93da8fb2bbc
-
SSDEEP
12288:AU5rCOTeioGqmp/Rgb/PvzKOoSRN9+fdb+dNZulFVg0M1:AUQOJoGqEgjv+OomN9ohwNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3684 46FC.tmp 924 4769.tmp 2092 47C7.tmp 2756 4863.tmp 1768 48D0.tmp 1924 493E.tmp 2792 49DA.tmp 2148 4A38.tmp 1908 4AD4.tmp 1688 4B70.tmp 1692 4BFD.tmp 3648 4C5B.tmp 2020 4CC8.tmp 2232 4D35.tmp 4240 4D84.tmp 5044 4DF1.tmp 4764 4E6E.tmp 3772 4EDB.tmp 4188 4F29.tmp 3068 4F97.tmp 4416 5014.tmp 2068 5081.tmp 2380 50DF.tmp 2312 516C.tmp 5040 51C9.tmp 3336 5227.tmp 3740 5285.tmp 4136 52E3.tmp 876 5350.tmp 2040 53BD.tmp 5024 540B.tmp 3708 5488.tmp 2084 5505.tmp 1160 5563.tmp 1244 55C1.tmp 3520 560F.tmp 2844 566D.tmp 1048 56DA.tmp 5020 5728.tmp 2940 5786.tmp 1516 57D4.tmp 2836 5832.tmp 4516 5880.tmp 2340 58DE.tmp 1168 592C.tmp 4260 598A.tmp 2252 59D8.tmp 1432 5A36.tmp 4608 5A93.tmp 3420 5AF1.tmp 212 5B4F.tmp 3648 5BAD.tmp 1324 5C0A.tmp 2072 5C68.tmp 3680 5CC6.tmp 2616 5D24.tmp 4900 5D81.tmp 4476 5DCF.tmp 2376 5E1E.tmp 4480 5E7B.tmp 1848 5ED9.tmp 4720 5F37.tmp 1200 5F85.tmp 1708 5FE3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 3684 3576 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 83 PID 3576 wrote to memory of 3684 3576 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 83 PID 3576 wrote to memory of 3684 3576 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 83 PID 3684 wrote to memory of 924 3684 46FC.tmp 84 PID 3684 wrote to memory of 924 3684 46FC.tmp 84 PID 3684 wrote to memory of 924 3684 46FC.tmp 84 PID 924 wrote to memory of 2092 924 4769.tmp 85 PID 924 wrote to memory of 2092 924 4769.tmp 85 PID 924 wrote to memory of 2092 924 4769.tmp 85 PID 2092 wrote to memory of 2756 2092 47C7.tmp 86 PID 2092 wrote to memory of 2756 2092 47C7.tmp 86 PID 2092 wrote to memory of 2756 2092 47C7.tmp 86 PID 2756 wrote to memory of 1768 2756 4863.tmp 87 PID 2756 wrote to memory of 1768 2756 4863.tmp 87 PID 2756 wrote to memory of 1768 2756 4863.tmp 87 PID 1768 wrote to memory of 1924 1768 48D0.tmp 89 PID 1768 wrote to memory of 1924 1768 48D0.tmp 89 PID 1768 wrote to memory of 1924 1768 48D0.tmp 89 PID 1924 wrote to memory of 2792 1924 493E.tmp 90 PID 1924 wrote to memory of 2792 1924 493E.tmp 90 PID 1924 wrote to memory of 2792 1924 493E.tmp 90 PID 2792 wrote to memory of 2148 2792 49DA.tmp 92 PID 2792 wrote to memory of 2148 2792 49DA.tmp 92 PID 2792 wrote to memory of 2148 2792 49DA.tmp 92 PID 2148 wrote to memory of 1908 2148 4A38.tmp 93 PID 2148 wrote to memory of 1908 2148 4A38.tmp 93 PID 2148 wrote to memory of 1908 2148 4A38.tmp 93 PID 1908 wrote to memory of 1688 1908 4AD4.tmp 95 PID 1908 wrote to memory of 1688 1908 4AD4.tmp 95 PID 1908 wrote to memory of 1688 1908 4AD4.tmp 95 PID 1688 wrote to memory of 1692 1688 4B70.tmp 96 PID 1688 wrote to memory of 1692 1688 4B70.tmp 96 PID 1688 wrote to memory of 1692 1688 4B70.tmp 96 PID 1692 wrote to memory of 3648 1692 4BFD.tmp 97 PID 1692 wrote to memory of 3648 1692 4BFD.tmp 97 PID 1692 wrote to memory of 3648 1692 4BFD.tmp 97 PID 3648 wrote to memory of 2020 3648 4C5B.tmp 98 PID 3648 wrote to memory of 2020 3648 4C5B.tmp 98 PID 3648 wrote to memory of 2020 3648 4C5B.tmp 98 PID 2020 wrote to memory of 2232 2020 4CC8.tmp 99 PID 2020 wrote to memory of 2232 2020 4CC8.tmp 99 PID 2020 wrote to memory of 2232 2020 4CC8.tmp 99 PID 2232 wrote to memory of 4240 2232 4D35.tmp 100 PID 2232 wrote to memory of 4240 2232 4D35.tmp 100 PID 2232 wrote to memory of 4240 2232 4D35.tmp 100 PID 4240 wrote to memory of 5044 4240 4D84.tmp 101 PID 4240 wrote to memory of 5044 4240 4D84.tmp 101 PID 4240 wrote to memory of 5044 4240 4D84.tmp 101 PID 5044 wrote to memory of 4764 5044 4DF1.tmp 102 PID 5044 wrote to memory of 4764 5044 4DF1.tmp 102 PID 5044 wrote to memory of 4764 5044 4DF1.tmp 102 PID 4764 wrote to memory of 3772 4764 4E6E.tmp 103 PID 4764 wrote to memory of 3772 4764 4E6E.tmp 103 PID 4764 wrote to memory of 3772 4764 4E6E.tmp 103 PID 3772 wrote to memory of 4188 3772 4EDB.tmp 104 PID 3772 wrote to memory of 4188 3772 4EDB.tmp 104 PID 3772 wrote to memory of 4188 3772 4EDB.tmp 104 PID 4188 wrote to memory of 3068 4188 4F29.tmp 105 PID 4188 wrote to memory of 3068 4188 4F29.tmp 105 PID 4188 wrote to memory of 3068 4188 4F29.tmp 105 PID 3068 wrote to memory of 4416 3068 4F97.tmp 106 PID 3068 wrote to memory of 4416 3068 4F97.tmp 106 PID 3068 wrote to memory of 4416 3068 4F97.tmp 106 PID 4416 wrote to memory of 2068 4416 5014.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"23⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"24⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"25⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"26⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"27⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"28⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"29⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"30⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"31⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"32⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"33⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"34⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"35⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"36⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"37⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"38⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"39⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"40⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"41⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"42⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"43⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"44⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"45⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"46⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"47⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"48⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"49⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"50⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"51⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"52⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"53⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"54⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"55⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"56⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"57⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"58⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"59⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"60⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"62⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"63⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"64⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"65⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"66⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"67⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"68⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"69⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"70⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"71⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"72⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"73⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"74⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"75⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"76⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"77⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"78⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"79⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"80⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"81⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"82⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"83⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"84⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"85⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"86⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"87⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"88⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"89⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"90⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"91⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"92⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"93⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"94⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"95⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"96⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"97⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"98⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"99⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"100⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"101⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"102⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"103⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"104⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"105⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"106⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"107⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"108⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"109⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"110⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"111⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"112⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"113⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"114⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"115⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"116⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"117⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"118⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"119⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"120⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"121⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"122⤵PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-