Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 13:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe
-
Size
486KB
-
MD5
616a2f3b6c3f101a7906b260072cd4e8
-
SHA1
98278787e6ee8fa1f61461a406bc45f44b0c373c
-
SHA256
43c50ff5d1356e932d3da41decb05dacf08ac94dee14fc695e37dfbde48fd996
-
SHA512
137d61b13ef3a1b3b720f52e70f0809212991f68c8b7b39286e015453df391447ef729d8e8a0f140c67989e250841aff96e7501c3af680dce2312ee67c207584
-
SSDEEP
12288:UU5rCOTeiD5IAVnO8jjst5FM1Wnkd+JjEWNZ:UUQOJDfNjsrFM1AiCjN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5196 3911.tmp 5236 399E.tmp 3964 3A2A.tmp 1508 3AE6.tmp 4948 3B73.tmp 3276 3C0F.tmp 1288 3C6D.tmp 3688 3CDA.tmp 4320 3D47.tmp 2412 3DB5.tmp 5244 3E22.tmp 5060 3E9F.tmp 2196 3F1C.tmp 3656 3F7A.tmp 2168 3FE7.tmp 432 4064.tmp 1940 40E1.tmp 3608 413F.tmp 3780 41CC.tmp 5596 4239.tmp 1736 42B6.tmp 5720 4323.tmp 5600 43A0.tmp 3808 441D.tmp 5284 447B.tmp 3632 4508.tmp 4868 4565.tmp 428 4602.tmp 3204 466F.tmp 5816 46EC.tmp 4124 4769.tmp 4884 47E6.tmp 832 4853.tmp 5268 48C1.tmp 2020 492E.tmp 3692 499C.tmp 764 49EA.tmp 2336 4A47.tmp 5792 4AB5.tmp 2552 4B13.tmp 5376 4B70.tmp 5828 4BED.tmp 5112 4C5B.tmp 5848 4CC8.tmp 5516 4D26.tmp 5592 4D84.tmp 1920 4DE1.tmp 5248 4E3F.tmp 3384 4EAC.tmp 5448 4F1A.tmp 3452 4F78.tmp 4788 4FC6.tmp 5508 5023.tmp 1336 50B0.tmp 6084 511D.tmp 5128 518B.tmp 2708 51F8.tmp 1504 5246.tmp 932 52B4.tmp 1060 5311.tmp 2160 537F.tmp 5400 53DD.tmp 2060 543A.tmp 2064 5498.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 5196 4696 2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe 82 PID 4696 wrote to memory of 5196 4696 2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe 82 PID 4696 wrote to memory of 5196 4696 2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe 82 PID 5196 wrote to memory of 5236 5196 3911.tmp 83 PID 5196 wrote to memory of 5236 5196 3911.tmp 83 PID 5196 wrote to memory of 5236 5196 3911.tmp 83 PID 5236 wrote to memory of 3964 5236 399E.tmp 84 PID 5236 wrote to memory of 3964 5236 399E.tmp 84 PID 5236 wrote to memory of 3964 5236 399E.tmp 84 PID 3964 wrote to memory of 1508 3964 3A2A.tmp 85 PID 3964 wrote to memory of 1508 3964 3A2A.tmp 85 PID 3964 wrote to memory of 1508 3964 3A2A.tmp 85 PID 1508 wrote to memory of 4948 1508 3AE6.tmp 86 PID 1508 wrote to memory of 4948 1508 3AE6.tmp 86 PID 1508 wrote to memory of 4948 1508 3AE6.tmp 86 PID 4948 wrote to memory of 3276 4948 3B73.tmp 87 PID 4948 wrote to memory of 3276 4948 3B73.tmp 87 PID 4948 wrote to memory of 3276 4948 3B73.tmp 87 PID 3276 wrote to memory of 1288 3276 3C0F.tmp 89 PID 3276 wrote to memory of 1288 3276 3C0F.tmp 89 PID 3276 wrote to memory of 1288 3276 3C0F.tmp 89 PID 1288 wrote to memory of 3688 1288 3C6D.tmp 91 PID 1288 wrote to memory of 3688 1288 3C6D.tmp 91 PID 1288 wrote to memory of 3688 1288 3C6D.tmp 91 PID 3688 wrote to memory of 4320 3688 3CDA.tmp 93 PID 3688 wrote to memory of 4320 3688 3CDA.tmp 93 PID 3688 wrote to memory of 4320 3688 3CDA.tmp 93 PID 4320 wrote to memory of 2412 4320 3D47.tmp 94 PID 4320 wrote to memory of 2412 4320 3D47.tmp 94 PID 4320 wrote to memory of 2412 4320 3D47.tmp 94 PID 2412 wrote to memory of 5244 2412 3DB5.tmp 95 PID 2412 wrote to memory of 5244 2412 3DB5.tmp 95 PID 2412 wrote to memory of 5244 2412 3DB5.tmp 95 PID 5244 wrote to memory of 5060 5244 3E22.tmp 96 PID 5244 wrote to memory of 5060 5244 3E22.tmp 96 PID 5244 wrote to memory of 5060 5244 3E22.tmp 96 PID 5060 wrote to memory of 2196 5060 3E9F.tmp 97 PID 5060 wrote to memory of 2196 5060 3E9F.tmp 97 PID 5060 wrote to memory of 2196 5060 3E9F.tmp 97 PID 2196 wrote to memory of 3656 2196 3F1C.tmp 98 PID 2196 wrote to memory of 3656 2196 3F1C.tmp 98 PID 2196 wrote to memory of 3656 2196 3F1C.tmp 98 PID 3656 wrote to memory of 2168 3656 3F7A.tmp 99 PID 3656 wrote to memory of 2168 3656 3F7A.tmp 99 PID 3656 wrote to memory of 2168 3656 3F7A.tmp 99 PID 2168 wrote to memory of 432 2168 3FE7.tmp 100 PID 2168 wrote to memory of 432 2168 3FE7.tmp 100 PID 2168 wrote to memory of 432 2168 3FE7.tmp 100 PID 432 wrote to memory of 1940 432 4064.tmp 101 PID 432 wrote to memory of 1940 432 4064.tmp 101 PID 432 wrote to memory of 1940 432 4064.tmp 101 PID 1940 wrote to memory of 3608 1940 40E1.tmp 102 PID 1940 wrote to memory of 3608 1940 40E1.tmp 102 PID 1940 wrote to memory of 3608 1940 40E1.tmp 102 PID 3608 wrote to memory of 3780 3608 413F.tmp 103 PID 3608 wrote to memory of 3780 3608 413F.tmp 103 PID 3608 wrote to memory of 3780 3608 413F.tmp 103 PID 3780 wrote to memory of 5596 3780 41CC.tmp 104 PID 3780 wrote to memory of 5596 3780 41CC.tmp 104 PID 3780 wrote to memory of 5596 3780 41CC.tmp 104 PID 5596 wrote to memory of 1736 5596 4239.tmp 105 PID 5596 wrote to memory of 1736 5596 4239.tmp 105 PID 5596 wrote to memory of 1736 5596 4239.tmp 105 PID 1736 wrote to memory of 5720 1736 42B6.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_616a2f3b6c3f101a7906b260072cd4e8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"23⤵
- Executes dropped EXE
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"24⤵
- Executes dropped EXE
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"25⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"26⤵
- Executes dropped EXE
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"27⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"28⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"29⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"30⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"31⤵
- Executes dropped EXE
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"32⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"33⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"34⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"35⤵
- Executes dropped EXE
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"36⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"37⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"38⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"39⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"40⤵
- Executes dropped EXE
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"41⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"42⤵
- Executes dropped EXE
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"43⤵
- Executes dropped EXE
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"44⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"45⤵
- Executes dropped EXE
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"46⤵
- Executes dropped EXE
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"47⤵
- Executes dropped EXE
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"48⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"49⤵
- Executes dropped EXE
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"50⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"51⤵
- Executes dropped EXE
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"52⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"53⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"54⤵
- Executes dropped EXE
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"55⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"56⤵
- Executes dropped EXE
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"57⤵
- Executes dropped EXE
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"58⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"59⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"60⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"61⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"62⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"63⤵
- Executes dropped EXE
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"64⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"65⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"66⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"67⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"68⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"69⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"70⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"71⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"72⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"73⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"74⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"75⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"76⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"77⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"78⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"79⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"80⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"81⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"83⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"84⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"85⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"86⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"87⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"88⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"90⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"91⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"92⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"93⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"94⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"95⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"96⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"97⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"98⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"99⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"100⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"101⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"102⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"103⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"104⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"105⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"106⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"107⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"108⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"109⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"110⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"111⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"112⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"113⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"114⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"115⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"116⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"117⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"118⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"119⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"120⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"121⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-