Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe
-
Size
488KB
-
MD5
740238b722625dbcd7694447178e5d9a
-
SHA1
73c20489b2669d57f5c28fb062e4ce8152b0b60c
-
SHA256
320d78043240f3db0a2a4bf0ddc5f3ec0c6e4c4c1791a33cb9103364506bb289
-
SHA512
1d449573339cfd6a53078ae604ea34eeb68ad635ab5d7838f6a1212f1f42ab3d56aa0760fbd42a5dfbaf8ab7ea3a3effd52e7ca6e20188dc0913102eba913b8c
-
SSDEEP
12288:/U5rCOTeiDhHswTg96+tBSpaq7zuUQdV6BBNZ:/UQOJDZTgnHS8QuUQz6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3056 4AC4.tmp 4740 4B32.tmp 4200 4BAF.tmp 4376 4C1C.tmp 4024 4C99.tmp 4332 4CF7.tmp 556 4D55.tmp 2616 4DA3.tmp 4236 4E10.tmp 2784 4E6E.tmp 2284 4EDB.tmp 1516 4F39.tmp 1892 4F87.tmp 2976 4FE5.tmp 712 5033.tmp 3340 5081.tmp 2888 50DF.tmp 4608 512D.tmp 3928 518B.tmp 980 51D9.tmp 2160 5237.tmp 4460 5294.tmp 1004 52E3.tmp 4592 5350.tmp 1172 539E.tmp 1252 53EC.tmp 1432 543A.tmp 2556 5488.tmp 1480 54E6.tmp 4428 5534.tmp 1096 5582.tmp 2012 55F0.tmp 5040 563E.tmp 3652 568C.tmp 1524 56EA.tmp 3896 5738.tmp 2472 5786.tmp 1656 57D4.tmp 3780 5822.tmp 3952 5870.tmp 2400 58BF.tmp 4712 592C.tmp 1372 597A.tmp 2440 59C8.tmp 3500 5A16.tmp 1616 5A64.tmp 3640 5AB3.tmp 3864 5B20.tmp 1588 5BAD.tmp 3460 5C39.tmp 1292 5CD5.tmp 4052 5D24.tmp 2932 5D81.tmp 5008 5DCF.tmp 3636 5E3D.tmp 1392 5E8B.tmp 2324 5EE9.tmp 4668 5F46.tmp 116 5FA4.tmp 4800 5FF2.tmp 1892 6050.tmp 4320 609E.tmp 3588 60EC.tmp 5012 613A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 3056 1776 2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe 84 PID 1776 wrote to memory of 3056 1776 2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe 84 PID 1776 wrote to memory of 3056 1776 2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe 84 PID 3056 wrote to memory of 4740 3056 4AC4.tmp 86 PID 3056 wrote to memory of 4740 3056 4AC4.tmp 86 PID 3056 wrote to memory of 4740 3056 4AC4.tmp 86 PID 4740 wrote to memory of 4200 4740 4B32.tmp 88 PID 4740 wrote to memory of 4200 4740 4B32.tmp 88 PID 4740 wrote to memory of 4200 4740 4B32.tmp 88 PID 4200 wrote to memory of 4376 4200 4BAF.tmp 90 PID 4200 wrote to memory of 4376 4200 4BAF.tmp 90 PID 4200 wrote to memory of 4376 4200 4BAF.tmp 90 PID 4376 wrote to memory of 4024 4376 4C1C.tmp 91 PID 4376 wrote to memory of 4024 4376 4C1C.tmp 91 PID 4376 wrote to memory of 4024 4376 4C1C.tmp 91 PID 4024 wrote to memory of 4332 4024 4C99.tmp 92 PID 4024 wrote to memory of 4332 4024 4C99.tmp 92 PID 4024 wrote to memory of 4332 4024 4C99.tmp 92 PID 4332 wrote to memory of 556 4332 4CF7.tmp 93 PID 4332 wrote to memory of 556 4332 4CF7.tmp 93 PID 4332 wrote to memory of 556 4332 4CF7.tmp 93 PID 556 wrote to memory of 2616 556 4D55.tmp 94 PID 556 wrote to memory of 2616 556 4D55.tmp 94 PID 556 wrote to memory of 2616 556 4D55.tmp 94 PID 2616 wrote to memory of 4236 2616 4DA3.tmp 95 PID 2616 wrote to memory of 4236 2616 4DA3.tmp 95 PID 2616 wrote to memory of 4236 2616 4DA3.tmp 95 PID 4236 wrote to memory of 2784 4236 4E10.tmp 96 PID 4236 wrote to memory of 2784 4236 4E10.tmp 96 PID 4236 wrote to memory of 2784 4236 4E10.tmp 96 PID 2784 wrote to memory of 2284 2784 4E6E.tmp 97 PID 2784 wrote to memory of 2284 2784 4E6E.tmp 97 PID 2784 wrote to memory of 2284 2784 4E6E.tmp 97 PID 2284 wrote to memory of 1516 2284 4EDB.tmp 98 PID 2284 wrote to memory of 1516 2284 4EDB.tmp 98 PID 2284 wrote to memory of 1516 2284 4EDB.tmp 98 PID 1516 wrote to memory of 1892 1516 4F39.tmp 99 PID 1516 wrote to memory of 1892 1516 4F39.tmp 99 PID 1516 wrote to memory of 1892 1516 4F39.tmp 99 PID 1892 wrote to memory of 2976 1892 4F87.tmp 100 PID 1892 wrote to memory of 2976 1892 4F87.tmp 100 PID 1892 wrote to memory of 2976 1892 4F87.tmp 100 PID 2976 wrote to memory of 712 2976 4FE5.tmp 101 PID 2976 wrote to memory of 712 2976 4FE5.tmp 101 PID 2976 wrote to memory of 712 2976 4FE5.tmp 101 PID 712 wrote to memory of 3340 712 5033.tmp 102 PID 712 wrote to memory of 3340 712 5033.tmp 102 PID 712 wrote to memory of 3340 712 5033.tmp 102 PID 3340 wrote to memory of 2888 3340 5081.tmp 103 PID 3340 wrote to memory of 2888 3340 5081.tmp 103 PID 3340 wrote to memory of 2888 3340 5081.tmp 103 PID 2888 wrote to memory of 4608 2888 50DF.tmp 104 PID 2888 wrote to memory of 4608 2888 50DF.tmp 104 PID 2888 wrote to memory of 4608 2888 50DF.tmp 104 PID 4608 wrote to memory of 3928 4608 512D.tmp 105 PID 4608 wrote to memory of 3928 4608 512D.tmp 105 PID 4608 wrote to memory of 3928 4608 512D.tmp 105 PID 3928 wrote to memory of 980 3928 518B.tmp 106 PID 3928 wrote to memory of 980 3928 518B.tmp 106 PID 3928 wrote to memory of 980 3928 518B.tmp 106 PID 980 wrote to memory of 2160 980 51D9.tmp 107 PID 980 wrote to memory of 2160 980 51D9.tmp 107 PID 980 wrote to memory of 2160 980 51D9.tmp 107 PID 2160 wrote to memory of 4460 2160 5237.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_740238b722625dbcd7694447178e5d9a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"23⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"24⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"25⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"26⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"27⤵
- Executes dropped EXE
PID:1252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"1⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"2⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"3⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"4⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"5⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"6⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"7⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"8⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"9⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"10⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"11⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"12⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"13⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"14⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"15⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"16⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"17⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"18⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"19⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"20⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"21⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"22⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"23⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"24⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"25⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"26⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"27⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"28⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"29⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"30⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"31⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"32⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"33⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"34⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"35⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"36⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"37⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"38⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"39⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"40⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"41⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"42⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"43⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"44⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"45⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"46⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"47⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"48⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"49⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"50⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"51⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"52⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"53⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"54⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"55⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"56⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"57⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"58⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"59⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"60⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"61⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"62⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"63⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"64⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"65⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"66⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"67⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"68⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"69⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"70⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"71⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"72⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"73⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"74⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"75⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"76⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"77⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"78⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"79⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"80⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"81⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"82⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"83⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"84⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"85⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"86⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"87⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"88⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"89⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"90⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"91⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"92⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"93⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"94⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"95⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"96⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"98⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"99⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"100⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"101⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"102⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"103⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"104⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"105⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"106⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"107⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"108⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"109⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"110⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"111⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"112⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"113⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"115⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"116⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"117⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"118⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"119⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"120⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"121⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"122⤵PID:4088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-