Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe
-
Size
520KB
-
MD5
e0d47f41f52c00b5d123089b7bb5c71f
-
SHA1
be210fcb3c506a4c396e3ea8b15a0744d96d24f3
-
SHA256
49fe2795b765544cda70ffbfcccceffca01311c3a4504ab70bfe22ebbbc4f801
-
SHA512
5a7ee34b759a648cdc828c3f020b00e3bff7238c94ff9cbfa9ce57afe115cbb2de76584cde6d0583b3927aae329f0897cce3a93aa000dc29a455c8e95e5534ed
-
SSDEEP
12288:gj8fuxR21t5i8fTR/+ttMsdaU2sFqaL6i8VNZ:gj8fuK1GYt/+PNdG0L38VN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4448 421A.tmp 876 42A6.tmp 4000 42F4.tmp 700 4381.tmp 3404 43EE.tmp 1420 445C.tmp 4492 4508.tmp 4880 4585.tmp 1948 45E2.tmp 3784 4640.tmp 4464 46BD.tmp 1792 472B.tmp 2892 4779.tmp 1068 47F6.tmp 2620 4863.tmp 4380 48D0.tmp 2948 492E.tmp 4516 498C.tmp 872 49EA.tmp 5108 4A47.tmp 3620 4A96.tmp 3388 4B13.tmp 456 4B90.tmp 3472 4BFD.tmp 3296 4C8A.tmp 4820 4CE7.tmp 4576 4D45.tmp 1152 4DA3.tmp 2096 4DF1.tmp 1016 4E6E.tmp 4500 4EEB.tmp 2360 4F58.tmp 4808 4FB6.tmp 4424 5004.tmp 4420 5052.tmp 3916 50A0.tmp 224 50EF.tmp 4784 513D.tmp 700 518B.tmp 4932 51E9.tmp 3552 5246.tmp 3324 5294.tmp 1876 52E3.tmp 1420 5340.tmp 4492 538E.tmp 1248 53EC.tmp 4620 543A.tmp 3944 5498.tmp 4980 54E6.tmp 2004 5544.tmp 2252 5592.tmp 3588 55F0.tmp 3836 563E.tmp 2892 569C.tmp 2588 56F9.tmp 1696 5748.tmp 2380 5796.tmp 4316 57F3.tmp 1732 5842.tmp 4776 589F.tmp 2888 58ED.tmp 4516 593C.tmp 3304 5999.tmp 3572 59F7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4448 3928 2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe 84 PID 3928 wrote to memory of 4448 3928 2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe 84 PID 3928 wrote to memory of 4448 3928 2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe 84 PID 4448 wrote to memory of 876 4448 421A.tmp 85 PID 4448 wrote to memory of 876 4448 421A.tmp 85 PID 4448 wrote to memory of 876 4448 421A.tmp 85 PID 876 wrote to memory of 4000 876 42A6.tmp 86 PID 876 wrote to memory of 4000 876 42A6.tmp 86 PID 876 wrote to memory of 4000 876 42A6.tmp 86 PID 4000 wrote to memory of 700 4000 42F4.tmp 88 PID 4000 wrote to memory of 700 4000 42F4.tmp 88 PID 4000 wrote to memory of 700 4000 42F4.tmp 88 PID 700 wrote to memory of 3404 700 4381.tmp 90 PID 700 wrote to memory of 3404 700 4381.tmp 90 PID 700 wrote to memory of 3404 700 4381.tmp 90 PID 3404 wrote to memory of 1420 3404 43EE.tmp 91 PID 3404 wrote to memory of 1420 3404 43EE.tmp 91 PID 3404 wrote to memory of 1420 3404 43EE.tmp 91 PID 1420 wrote to memory of 4492 1420 445C.tmp 93 PID 1420 wrote to memory of 4492 1420 445C.tmp 93 PID 1420 wrote to memory of 4492 1420 445C.tmp 93 PID 4492 wrote to memory of 4880 4492 4508.tmp 94 PID 4492 wrote to memory of 4880 4492 4508.tmp 94 PID 4492 wrote to memory of 4880 4492 4508.tmp 94 PID 4880 wrote to memory of 1948 4880 4585.tmp 95 PID 4880 wrote to memory of 1948 4880 4585.tmp 95 PID 4880 wrote to memory of 1948 4880 4585.tmp 95 PID 1948 wrote to memory of 3784 1948 45E2.tmp 96 PID 1948 wrote to memory of 3784 1948 45E2.tmp 96 PID 1948 wrote to memory of 3784 1948 45E2.tmp 96 PID 3784 wrote to memory of 4464 3784 4640.tmp 97 PID 3784 wrote to memory of 4464 3784 4640.tmp 97 PID 3784 wrote to memory of 4464 3784 4640.tmp 97 PID 4464 wrote to memory of 1792 4464 46BD.tmp 98 PID 4464 wrote to memory of 1792 4464 46BD.tmp 98 PID 4464 wrote to memory of 1792 4464 46BD.tmp 98 PID 1792 wrote to memory of 2892 1792 472B.tmp 99 PID 1792 wrote to memory of 2892 1792 472B.tmp 99 PID 1792 wrote to memory of 2892 1792 472B.tmp 99 PID 2892 wrote to memory of 1068 2892 4779.tmp 100 PID 2892 wrote to memory of 1068 2892 4779.tmp 100 PID 2892 wrote to memory of 1068 2892 4779.tmp 100 PID 1068 wrote to memory of 2620 1068 47F6.tmp 101 PID 1068 wrote to memory of 2620 1068 47F6.tmp 101 PID 1068 wrote to memory of 2620 1068 47F6.tmp 101 PID 2620 wrote to memory of 4380 2620 4863.tmp 102 PID 2620 wrote to memory of 4380 2620 4863.tmp 102 PID 2620 wrote to memory of 4380 2620 4863.tmp 102 PID 4380 wrote to memory of 2948 4380 48D0.tmp 103 PID 4380 wrote to memory of 2948 4380 48D0.tmp 103 PID 4380 wrote to memory of 2948 4380 48D0.tmp 103 PID 2948 wrote to memory of 4516 2948 492E.tmp 104 PID 2948 wrote to memory of 4516 2948 492E.tmp 104 PID 2948 wrote to memory of 4516 2948 492E.tmp 104 PID 4516 wrote to memory of 872 4516 498C.tmp 106 PID 4516 wrote to memory of 872 4516 498C.tmp 106 PID 4516 wrote to memory of 872 4516 498C.tmp 106 PID 872 wrote to memory of 5108 872 49EA.tmp 107 PID 872 wrote to memory of 5108 872 49EA.tmp 107 PID 872 wrote to memory of 5108 872 49EA.tmp 107 PID 5108 wrote to memory of 3620 5108 4A47.tmp 108 PID 5108 wrote to memory of 3620 5108 4A47.tmp 108 PID 5108 wrote to memory of 3620 5108 4A47.tmp 108 PID 3620 wrote to memory of 3388 3620 4A96.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_e0d47f41f52c00b5d123089b7bb5c71f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"23⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"24⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"25⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"26⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"27⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"28⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"29⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"30⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"31⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"32⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"33⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"34⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"35⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"36⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"37⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"38⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"39⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"40⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"41⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"42⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"43⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"44⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"45⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"46⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"47⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"48⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"49⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"50⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"51⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"52⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"53⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"54⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"55⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"56⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"57⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"58⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"59⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"60⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"61⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"62⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"63⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"64⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"65⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"66⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"67⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"68⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"69⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"70⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"71⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"73⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"74⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"75⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"76⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"77⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"78⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"80⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"81⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"82⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"83⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"84⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"85⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"86⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"87⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"88⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"89⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"90⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"91⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"92⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"93⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"94⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"95⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"96⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"97⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"99⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"100⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"101⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"103⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"104⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"105⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"106⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"107⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"108⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"109⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"110⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"111⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"112⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"113⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"115⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"116⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"117⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"118⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"119⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"120⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"121⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"122⤵PID:4024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-