Analysis
-
max time kernel
124s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe
-
Size
530KB
-
MD5
97f74d99c3293596fddf1cc304d2097e
-
SHA1
390687d6dfd5ba0fbb1d97fd51836c9f940217cf
-
SHA256
4ca0bb845bbe407ab2b4d36f29ce380e5c2012fc4674e76515eff2ee40a17060
-
SHA512
920afc2adec6bd1b2912ef9890138f4647f6add0a95ef3802e0eca7c585615bc4218724785f49890a85ca0a92ec1f0128500ceb056560cddacd3697ac07f116a
-
SSDEEP
12288:AU5rCOTeiolqn8rYG+LCvJixN7GEQPpzptQmhaxwpGNZulFVg0M1:AUQOJolK88V4+RGEepzLQZwMNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3488 3F1C.tmp 4324 3F7A.tmp 2948 3FF7.tmp 3400 4093.tmp 1856 40F1.tmp 3640 416E.tmp 1176 41EB.tmp 5048 4249.tmp 388 42C6.tmp 1544 4314.tmp 632 43A0.tmp 4256 43FE.tmp 732 444C.tmp 4848 44BA.tmp 2400 4527.tmp 3820 4594.tmp 216 4611.tmp 2820 467F.tmp 1308 46EC.tmp 4884 474A.tmp 1736 47B7.tmp 3780 4834.tmp 3672 48B1.tmp 516 491F.tmp 3452 496D.tmp 4064 49DA.tmp 1380 4A47.tmp 3052 4AA5.tmp 4416 4B22.tmp 4940 4B9F.tmp 3036 4BFD.tmp 4308 4C7A.tmp 1608 4D07.tmp 1628 4D55.tmp 3488 4DA3.tmp 2136 4E01.tmp 4228 4E4F.tmp 1492 4EAC.tmp 1920 4EFB.tmp 4160 4F58.tmp 3400 4FB6.tmp 3964 5014.tmp 2116 5072.tmp 3956 50CF.tmp 3256 511D.tmp 3684 516C.tmp 1176 51C9.tmp 2424 5227.tmp 3724 5275.tmp 1156 52C3.tmp 4984 5311.tmp 4340 536F.tmp 632 53BD.tmp 1660 541B.tmp 4256 5469.tmp 4964 54B7.tmp 4712 5515.tmp 2400 5573.tmp 116 55D1.tmp 1976 562E.tmp 2652 568C.tmp 752 56EA.tmp 2820 5748.tmp 1308 57A5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 3488 3668 2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe 83 PID 3668 wrote to memory of 3488 3668 2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe 83 PID 3668 wrote to memory of 3488 3668 2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe 83 PID 3488 wrote to memory of 4324 3488 3F1C.tmp 84 PID 3488 wrote to memory of 4324 3488 3F1C.tmp 84 PID 3488 wrote to memory of 4324 3488 3F1C.tmp 84 PID 4324 wrote to memory of 2948 4324 3F7A.tmp 85 PID 4324 wrote to memory of 2948 4324 3F7A.tmp 85 PID 4324 wrote to memory of 2948 4324 3F7A.tmp 85 PID 2948 wrote to memory of 3400 2948 3FF7.tmp 87 PID 2948 wrote to memory of 3400 2948 3FF7.tmp 87 PID 2948 wrote to memory of 3400 2948 3FF7.tmp 87 PID 3400 wrote to memory of 1856 3400 4093.tmp 88 PID 3400 wrote to memory of 1856 3400 4093.tmp 88 PID 3400 wrote to memory of 1856 3400 4093.tmp 88 PID 1856 wrote to memory of 3640 1856 40F1.tmp 90 PID 1856 wrote to memory of 3640 1856 40F1.tmp 90 PID 1856 wrote to memory of 3640 1856 40F1.tmp 90 PID 3640 wrote to memory of 1176 3640 416E.tmp 91 PID 3640 wrote to memory of 1176 3640 416E.tmp 91 PID 3640 wrote to memory of 1176 3640 416E.tmp 91 PID 1176 wrote to memory of 5048 1176 41EB.tmp 93 PID 1176 wrote to memory of 5048 1176 41EB.tmp 93 PID 1176 wrote to memory of 5048 1176 41EB.tmp 93 PID 5048 wrote to memory of 388 5048 4249.tmp 94 PID 5048 wrote to memory of 388 5048 4249.tmp 94 PID 5048 wrote to memory of 388 5048 4249.tmp 94 PID 388 wrote to memory of 1544 388 42C6.tmp 95 PID 388 wrote to memory of 1544 388 42C6.tmp 95 PID 388 wrote to memory of 1544 388 42C6.tmp 95 PID 1544 wrote to memory of 632 1544 4314.tmp 96 PID 1544 wrote to memory of 632 1544 4314.tmp 96 PID 1544 wrote to memory of 632 1544 4314.tmp 96 PID 632 wrote to memory of 4256 632 43A0.tmp 97 PID 632 wrote to memory of 4256 632 43A0.tmp 97 PID 632 wrote to memory of 4256 632 43A0.tmp 97 PID 4256 wrote to memory of 732 4256 43FE.tmp 98 PID 4256 wrote to memory of 732 4256 43FE.tmp 98 PID 4256 wrote to memory of 732 4256 43FE.tmp 98 PID 732 wrote to memory of 4848 732 444C.tmp 99 PID 732 wrote to memory of 4848 732 444C.tmp 99 PID 732 wrote to memory of 4848 732 444C.tmp 99 PID 4848 wrote to memory of 2400 4848 44BA.tmp 100 PID 4848 wrote to memory of 2400 4848 44BA.tmp 100 PID 4848 wrote to memory of 2400 4848 44BA.tmp 100 PID 2400 wrote to memory of 3820 2400 4527.tmp 103 PID 2400 wrote to memory of 3820 2400 4527.tmp 103 PID 2400 wrote to memory of 3820 2400 4527.tmp 103 PID 3820 wrote to memory of 216 3820 4594.tmp 104 PID 3820 wrote to memory of 216 3820 4594.tmp 104 PID 3820 wrote to memory of 216 3820 4594.tmp 104 PID 216 wrote to memory of 2820 216 4611.tmp 105 PID 216 wrote to memory of 2820 216 4611.tmp 105 PID 216 wrote to memory of 2820 216 4611.tmp 105 PID 2820 wrote to memory of 1308 2820 467F.tmp 107 PID 2820 wrote to memory of 1308 2820 467F.tmp 107 PID 2820 wrote to memory of 1308 2820 467F.tmp 107 PID 1308 wrote to memory of 4884 1308 46EC.tmp 108 PID 1308 wrote to memory of 4884 1308 46EC.tmp 108 PID 1308 wrote to memory of 4884 1308 46EC.tmp 108 PID 4884 wrote to memory of 1736 4884 474A.tmp 109 PID 4884 wrote to memory of 1736 4884 474A.tmp 109 PID 4884 wrote to memory of 1736 4884 474A.tmp 109 PID 1736 wrote to memory of 3780 1736 47B7.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_97f74d99c3293596fddf1cc304d2097e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"23⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"24⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"25⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"26⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"27⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"28⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"29⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"30⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"31⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"32⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"33⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"34⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"35⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"36⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"37⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"38⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"39⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"40⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"41⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"42⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"43⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"44⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"45⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"46⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"47⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"48⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"49⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"50⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"51⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"52⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"53⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"54⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"55⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"56⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"57⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"58⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"59⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"60⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"61⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"62⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"63⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"64⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"65⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"66⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"67⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"68⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"69⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"70⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"71⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"72⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"73⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"74⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"75⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"76⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"77⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"78⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"79⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"80⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"81⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"82⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"83⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"84⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"85⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"86⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"87⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"88⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"89⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"90⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"91⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"92⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"93⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"94⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"95⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"96⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"97⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"98⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"99⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"100⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"101⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"102⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"103⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"104⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"105⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"106⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"107⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"108⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"109⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"110⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"111⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"112⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"113⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"114⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"115⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"116⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"117⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"118⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"119⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"120⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"121⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"122⤵PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-