Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe
-
Size
541KB
-
MD5
46dc06deb4c621a0d53080cf2caf63f3
-
SHA1
9b63c3d0e7f4d2e06c2b6b01ca517fc90a4570fe
-
SHA256
cb1393b83e286f0b4160217f15fe0c593c621b18e249fde05bbc214bbc4479c9
-
SHA512
23d92b0876cf9c1e6d16017698ca5aac5e6cba90a7ee02fe0c69bcf522fa3fa84ae76a8d6438d2edaf0ee7c532520248c911a92e29abdb93c5f26e0ff2041013
-
SSDEEP
12288:UU5rCOTeifliHib6mMDcMQ8X7QTjohOrZa73ctO:UUQOJf4s6mMis7QTj4OrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 872 4611.tmp 4220 46BD.tmp 744 4759.tmp 4400 47C7.tmp 4892 4844.tmp 1884 48C1.tmp 4568 490F.tmp 3376 496D.tmp 3764 4A09.tmp 1004 4A76.tmp 1304 4AD4.tmp 3284 4B32.tmp 2552 4BBE.tmp 2052 4C1C.tmp 1848 4C99.tmp 3108 4D07.tmp 4224 4D74.tmp 4720 4DF1.tmp 1200 4E5E.tmp 4684 4EDB.tmp 3384 4F39.tmp 1900 4FC6.tmp 4316 5023.tmp 1984 5072.tmp 1660 50DF.tmp 3796 515C.tmp 1320 51BA.tmp 3588 5246.tmp 2472 52A4.tmp 3328 5331.tmp 4372 537F.tmp 2640 53FC.tmp 3664 5498.tmp 5072 54E6.tmp 4416 5534.tmp 1020 5592.tmp 1420 55F0.tmp 1012 563E.tmp 1820 568C.tmp 4492 56DA.tmp 1940 5728.tmp 3016 5776.tmp 1400 57C5.tmp 2076 5822.tmp 1884 5880.tmp 1840 58CE.tmp 1304 592C.tmp 4932 597A.tmp 4916 59C8.tmp 1944 5A16.tmp 3636 5A74.tmp 4252 5AD2.tmp 2692 5B30.tmp 1564 5B8D.tmp 4696 5BFB.tmp 4836 5C58.tmp 4580 5CC6.tmp 3700 5D24.tmp 3968 5D81.tmp 1900 5DDF.tmp 3900 5E4C.tmp 1924 5EAA.tmp 1144 5F08.tmp 4736 5F66.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 872 2184 2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe 83 PID 2184 wrote to memory of 872 2184 2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe 83 PID 2184 wrote to memory of 872 2184 2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe 83 PID 872 wrote to memory of 4220 872 4611.tmp 84 PID 872 wrote to memory of 4220 872 4611.tmp 84 PID 872 wrote to memory of 4220 872 4611.tmp 84 PID 4220 wrote to memory of 744 4220 46BD.tmp 85 PID 4220 wrote to memory of 744 4220 46BD.tmp 85 PID 4220 wrote to memory of 744 4220 46BD.tmp 85 PID 744 wrote to memory of 4400 744 4759.tmp 86 PID 744 wrote to memory of 4400 744 4759.tmp 86 PID 744 wrote to memory of 4400 744 4759.tmp 86 PID 4400 wrote to memory of 4892 4400 47C7.tmp 88 PID 4400 wrote to memory of 4892 4400 47C7.tmp 88 PID 4400 wrote to memory of 4892 4400 47C7.tmp 88 PID 4892 wrote to memory of 1884 4892 4844.tmp 90 PID 4892 wrote to memory of 1884 4892 4844.tmp 90 PID 4892 wrote to memory of 1884 4892 4844.tmp 90 PID 1884 wrote to memory of 4568 1884 48C1.tmp 92 PID 1884 wrote to memory of 4568 1884 48C1.tmp 92 PID 1884 wrote to memory of 4568 1884 48C1.tmp 92 PID 4568 wrote to memory of 3376 4568 490F.tmp 93 PID 4568 wrote to memory of 3376 4568 490F.tmp 93 PID 4568 wrote to memory of 3376 4568 490F.tmp 93 PID 3376 wrote to memory of 3764 3376 496D.tmp 94 PID 3376 wrote to memory of 3764 3376 496D.tmp 94 PID 3376 wrote to memory of 3764 3376 496D.tmp 94 PID 3764 wrote to memory of 1004 3764 4A09.tmp 95 PID 3764 wrote to memory of 1004 3764 4A09.tmp 95 PID 3764 wrote to memory of 1004 3764 4A09.tmp 95 PID 1004 wrote to memory of 1304 1004 4A76.tmp 96 PID 1004 wrote to memory of 1304 1004 4A76.tmp 96 PID 1004 wrote to memory of 1304 1004 4A76.tmp 96 PID 1304 wrote to memory of 3284 1304 4AD4.tmp 97 PID 1304 wrote to memory of 3284 1304 4AD4.tmp 97 PID 1304 wrote to memory of 3284 1304 4AD4.tmp 97 PID 3284 wrote to memory of 2552 3284 4B32.tmp 98 PID 3284 wrote to memory of 2552 3284 4B32.tmp 98 PID 3284 wrote to memory of 2552 3284 4B32.tmp 98 PID 2552 wrote to memory of 2052 2552 4BBE.tmp 99 PID 2552 wrote to memory of 2052 2552 4BBE.tmp 99 PID 2552 wrote to memory of 2052 2552 4BBE.tmp 99 PID 2052 wrote to memory of 1848 2052 4C1C.tmp 101 PID 2052 wrote to memory of 1848 2052 4C1C.tmp 101 PID 2052 wrote to memory of 1848 2052 4C1C.tmp 101 PID 1848 wrote to memory of 3108 1848 4C99.tmp 102 PID 1848 wrote to memory of 3108 1848 4C99.tmp 102 PID 1848 wrote to memory of 3108 1848 4C99.tmp 102 PID 3108 wrote to memory of 4224 3108 4D07.tmp 103 PID 3108 wrote to memory of 4224 3108 4D07.tmp 103 PID 3108 wrote to memory of 4224 3108 4D07.tmp 103 PID 4224 wrote to memory of 4720 4224 4D74.tmp 104 PID 4224 wrote to memory of 4720 4224 4D74.tmp 104 PID 4224 wrote to memory of 4720 4224 4D74.tmp 104 PID 4720 wrote to memory of 1200 4720 4DF1.tmp 105 PID 4720 wrote to memory of 1200 4720 4DF1.tmp 105 PID 4720 wrote to memory of 1200 4720 4DF1.tmp 105 PID 1200 wrote to memory of 4684 1200 4E5E.tmp 106 PID 1200 wrote to memory of 4684 1200 4E5E.tmp 106 PID 1200 wrote to memory of 4684 1200 4E5E.tmp 106 PID 4684 wrote to memory of 3384 4684 4EDB.tmp 107 PID 4684 wrote to memory of 3384 4684 4EDB.tmp 107 PID 4684 wrote to memory of 3384 4684 4EDB.tmp 107 PID 3384 wrote to memory of 1900 3384 4F39.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_46dc06deb4c621a0d53080cf2caf63f3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"23⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"24⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"25⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"26⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"27⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"28⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"29⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"30⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"31⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"32⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"33⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"34⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"35⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"36⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"37⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"38⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"39⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"40⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"41⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"42⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"43⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"44⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"45⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"46⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"47⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"48⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"49⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"50⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"51⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"52⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"53⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"54⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"55⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"56⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"57⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"58⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"59⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"60⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"61⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"62⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"63⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"64⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"65⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"66⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"67⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"68⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"69⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"70⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"71⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"72⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"73⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"74⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"75⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"76⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"77⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"78⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"79⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"80⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"81⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"82⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"83⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"84⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"85⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"86⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"87⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"88⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"89⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"90⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"91⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"92⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"93⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"94⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"95⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"96⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"97⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"98⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"99⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"100⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"101⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"102⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"103⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"104⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"105⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"106⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"107⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"108⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"109⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"110⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"111⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"112⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"114⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"115⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"116⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"117⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"118⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"119⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"120⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"121⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"122⤵PID:3960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-