Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 19:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
-
Size
712KB
-
MD5
11b44bd0414beaa03fb73d73191cce16
-
SHA1
31158983de2ca5af37ee8c546e54d898392c839b
-
SHA256
d552e30c34b72fab6bd4415b89930c1b1b04da09ca9a6ff0743fa2ec147deb13
-
SHA512
25099daf7ceca3a8ccaec69ddf9b1ca521e208473a618b5d3f6d912770a7069feb651259a32748f43380668ef41f953f31e4a24925d39561376eab58bef2cd06
-
SSDEEP
12288:FU5rCOTeiDC/cZsQsmgnakEx43nrAr6wL4NZdCvq5TJLCvY90D8/LVBlVk736Y7k:FUQOJDC/os/R58oNnCvq5TJLCvY90D8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1164 3F7A.tmp 2488 3FE7.tmp 3576 4055.tmp 4084 40C2.tmp 4752 412F.tmp 2424 418D.tmp 3564 41FA.tmp 4904 4258.tmp 3944 42D5.tmp 2280 4343.tmp 3060 43B0.tmp 3652 442D.tmp 3792 448B.tmp 2244 4517.tmp 1940 4594.tmp 2472 4631.tmp 1060 468E.tmp 1204 46EC.tmp 3956 4759.tmp 2764 47C7.tmp 2336 4834.tmp 4868 48B1.tmp 2012 491F.tmp 372 497C.tmp 1676 49EA.tmp 4952 4A67.tmp 2332 4AB5.tmp 1936 4B32.tmp 1688 4BDE.tmp 2328 4C4B.tmp 4364 4C99.tmp 4980 4CF7.tmp 628 4D64.tmp 2380 4DC2.tmp 3372 4E20.tmp 1908 4E7E.tmp 2420 4EDB.tmp 3156 4F39.tmp 2160 4F97.tmp 1532 4FF5.tmp 4344 5052.tmp 2308 50B0.tmp 1652 510E.tmp 1320 516C.tmp 1956 51C9.tmp 3776 5227.tmp 4476 5285.tmp 3476 52E3.tmp 3604 5340.tmp 816 539E.tmp 1456 53FC.tmp 4244 544A.tmp 4872 54A8.tmp 5080 5505.tmp 5032 5563.tmp 4548 55C1.tmp 4276 561F.tmp 2392 567C.tmp 3944 56CB.tmp 3352 5728.tmp 4272 5786.tmp 3212 57D4.tmp 2620 5832.tmp 3108 5890.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1164 2796 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 82 PID 2796 wrote to memory of 1164 2796 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 82 PID 2796 wrote to memory of 1164 2796 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 82 PID 1164 wrote to memory of 2488 1164 3F7A.tmp 84 PID 1164 wrote to memory of 2488 1164 3F7A.tmp 84 PID 1164 wrote to memory of 2488 1164 3F7A.tmp 84 PID 2488 wrote to memory of 3576 2488 3FE7.tmp 85 PID 2488 wrote to memory of 3576 2488 3FE7.tmp 85 PID 2488 wrote to memory of 3576 2488 3FE7.tmp 85 PID 3576 wrote to memory of 4084 3576 4055.tmp 87 PID 3576 wrote to memory of 4084 3576 4055.tmp 87 PID 3576 wrote to memory of 4084 3576 4055.tmp 87 PID 4084 wrote to memory of 4752 4084 40C2.tmp 88 PID 4084 wrote to memory of 4752 4084 40C2.tmp 88 PID 4084 wrote to memory of 4752 4084 40C2.tmp 88 PID 4752 wrote to memory of 2424 4752 412F.tmp 89 PID 4752 wrote to memory of 2424 4752 412F.tmp 89 PID 4752 wrote to memory of 2424 4752 412F.tmp 89 PID 2424 wrote to memory of 3564 2424 418D.tmp 90 PID 2424 wrote to memory of 3564 2424 418D.tmp 90 PID 2424 wrote to memory of 3564 2424 418D.tmp 90 PID 3564 wrote to memory of 4904 3564 41FA.tmp 91 PID 3564 wrote to memory of 4904 3564 41FA.tmp 91 PID 3564 wrote to memory of 4904 3564 41FA.tmp 91 PID 4904 wrote to memory of 3944 4904 4258.tmp 92 PID 4904 wrote to memory of 3944 4904 4258.tmp 92 PID 4904 wrote to memory of 3944 4904 4258.tmp 92 PID 3944 wrote to memory of 2280 3944 42D5.tmp 93 PID 3944 wrote to memory of 2280 3944 42D5.tmp 93 PID 3944 wrote to memory of 2280 3944 42D5.tmp 93 PID 2280 wrote to memory of 3060 2280 4343.tmp 94 PID 2280 wrote to memory of 3060 2280 4343.tmp 94 PID 2280 wrote to memory of 3060 2280 4343.tmp 94 PID 3060 wrote to memory of 3652 3060 43B0.tmp 95 PID 3060 wrote to memory of 3652 3060 43B0.tmp 95 PID 3060 wrote to memory of 3652 3060 43B0.tmp 95 PID 3652 wrote to memory of 3792 3652 442D.tmp 96 PID 3652 wrote to memory of 3792 3652 442D.tmp 96 PID 3652 wrote to memory of 3792 3652 442D.tmp 96 PID 3792 wrote to memory of 2244 3792 448B.tmp 97 PID 3792 wrote to memory of 2244 3792 448B.tmp 97 PID 3792 wrote to memory of 2244 3792 448B.tmp 97 PID 2244 wrote to memory of 1940 2244 4517.tmp 98 PID 2244 wrote to memory of 1940 2244 4517.tmp 98 PID 2244 wrote to memory of 1940 2244 4517.tmp 98 PID 1940 wrote to memory of 2472 1940 4594.tmp 99 PID 1940 wrote to memory of 2472 1940 4594.tmp 99 PID 1940 wrote to memory of 2472 1940 4594.tmp 99 PID 2472 wrote to memory of 1060 2472 4631.tmp 100 PID 2472 wrote to memory of 1060 2472 4631.tmp 100 PID 2472 wrote to memory of 1060 2472 4631.tmp 100 PID 1060 wrote to memory of 1204 1060 468E.tmp 101 PID 1060 wrote to memory of 1204 1060 468E.tmp 101 PID 1060 wrote to memory of 1204 1060 468E.tmp 101 PID 1204 wrote to memory of 3956 1204 46EC.tmp 102 PID 1204 wrote to memory of 3956 1204 46EC.tmp 102 PID 1204 wrote to memory of 3956 1204 46EC.tmp 102 PID 3956 wrote to memory of 2764 3956 4759.tmp 105 PID 3956 wrote to memory of 2764 3956 4759.tmp 105 PID 3956 wrote to memory of 2764 3956 4759.tmp 105 PID 2764 wrote to memory of 2336 2764 47C7.tmp 106 PID 2764 wrote to memory of 2336 2764 47C7.tmp 106 PID 2764 wrote to memory of 2336 2764 47C7.tmp 106 PID 2336 wrote to memory of 4868 2336 4834.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"23⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"24⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"25⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"26⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"27⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"28⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"29⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"30⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"31⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"32⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"33⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"34⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"35⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"36⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"37⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"38⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"39⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"40⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"41⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"42⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"43⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"44⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"45⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"46⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"47⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"48⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"49⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"50⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"51⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"52⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"53⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"54⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"55⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"56⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"57⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"58⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"59⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"60⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"61⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"62⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"63⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"64⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"65⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"66⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"67⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"68⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"69⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"70⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"71⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"72⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"73⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"74⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"75⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"76⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"77⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"78⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"79⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"80⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"81⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"82⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"83⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"84⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"85⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"86⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"87⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"88⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"89⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"90⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"91⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"92⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"93⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"94⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"95⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"96⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"97⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"98⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"99⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"100⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"102⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"103⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"104⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"105⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"106⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"107⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"108⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"109⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"110⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"111⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"112⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"113⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"114⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"115⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"116⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"117⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"118⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"119⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"120⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"121⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-