Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
-
Size
488KB
-
MD5
5fbc2945cd1232695f51c4a1470d33f5
-
SHA1
d5bf1ba557f88b19740f5582164b32f410bac857
-
SHA256
23c34d2a2c8b02f72e8ab9d7738877166e25d042220430ed5ec4560124fb61e7
-
SHA512
843fff0636f83d267401f2b678bb3a79b58eb0f9f9809d93c500b7dec794fd918446ffb5d6b51eb1ee5cb8ed896787503188e5e0b8c15017931c031cc1a58b08
-
SSDEEP
12288:/U5rCOTeiDMj//1Sq84dHzXxFRdRNONZ:/UQOJDy9NbXRzsN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5032 3C4D.tmp 2108 3CBB.tmp 3100 3D09.tmp 3812 3D67.tmp 3124 3DD4.tmp 380 3E41.tmp 5076 3E9F.tmp 1748 3F0C.tmp 2528 3F6A.tmp 1116 3FB8.tmp 3860 4016.tmp 4512 4083.tmp 688 40E1.tmp 4760 412F.tmp 2996 419D.tmp 3712 420A.tmp 2176 4277.tmp 2400 42D5.tmp 4544 4343.tmp 436 43B0.tmp 4516 440E.tmp 2020 446B.tmp 3092 44BA.tmp 4560 4517.tmp 876 4575.tmp 2704 45C3.tmp 1664 4631.tmp 2224 46AE.tmp 2008 471B.tmp 4832 4798.tmp 1612 47E6.tmp 3588 4853.tmp 5036 48C1.tmp 2140 490F.tmp 4928 495D.tmp 4400 49AB.tmp 1928 4A09.tmp 3000 4A67.tmp 2468 4AB5.tmp 1684 4B03.tmp 3564 4B51.tmp 2992 4BAF.tmp 1984 4BFD.tmp 1572 4C4B.tmp 4528 4C99.tmp 2596 4D35.tmp 4068 4D84.tmp 388 4DD2.tmp 1412 4E20.tmp 2960 4E6E.tmp 1628 4ECC.tmp 736 4F1A.tmp 4212 4F68.tmp 4624 4FB6.tmp 3124 5004.tmp 1576 5062.tmp 1144 50C0.tmp 380 510E.tmp 4852 515C.tmp 3656 51AA.tmp 1748 51F8.tmp 2660 5246.tmp 760 5294.tmp 1116 52E3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 5032 3352 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 81 PID 3352 wrote to memory of 5032 3352 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 81 PID 3352 wrote to memory of 5032 3352 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 81 PID 5032 wrote to memory of 2108 5032 3C4D.tmp 82 PID 5032 wrote to memory of 2108 5032 3C4D.tmp 82 PID 5032 wrote to memory of 2108 5032 3C4D.tmp 82 PID 2108 wrote to memory of 3100 2108 3CBB.tmp 83 PID 2108 wrote to memory of 3100 2108 3CBB.tmp 83 PID 2108 wrote to memory of 3100 2108 3CBB.tmp 83 PID 3100 wrote to memory of 3812 3100 3D09.tmp 84 PID 3100 wrote to memory of 3812 3100 3D09.tmp 84 PID 3100 wrote to memory of 3812 3100 3D09.tmp 84 PID 3812 wrote to memory of 3124 3812 3D67.tmp 86 PID 3812 wrote to memory of 3124 3812 3D67.tmp 86 PID 3812 wrote to memory of 3124 3812 3D67.tmp 86 PID 3124 wrote to memory of 380 3124 3DD4.tmp 88 PID 3124 wrote to memory of 380 3124 3DD4.tmp 88 PID 3124 wrote to memory of 380 3124 3DD4.tmp 88 PID 380 wrote to memory of 5076 380 3E41.tmp 90 PID 380 wrote to memory of 5076 380 3E41.tmp 90 PID 380 wrote to memory of 5076 380 3E41.tmp 90 PID 5076 wrote to memory of 1748 5076 3E9F.tmp 91 PID 5076 wrote to memory of 1748 5076 3E9F.tmp 91 PID 5076 wrote to memory of 1748 5076 3E9F.tmp 91 PID 1748 wrote to memory of 2528 1748 3F0C.tmp 92 PID 1748 wrote to memory of 2528 1748 3F0C.tmp 92 PID 1748 wrote to memory of 2528 1748 3F0C.tmp 92 PID 2528 wrote to memory of 1116 2528 3F6A.tmp 93 PID 2528 wrote to memory of 1116 2528 3F6A.tmp 93 PID 2528 wrote to memory of 1116 2528 3F6A.tmp 93 PID 1116 wrote to memory of 3860 1116 3FB8.tmp 94 PID 1116 wrote to memory of 3860 1116 3FB8.tmp 94 PID 1116 wrote to memory of 3860 1116 3FB8.tmp 94 PID 3860 wrote to memory of 4512 3860 4016.tmp 95 PID 3860 wrote to memory of 4512 3860 4016.tmp 95 PID 3860 wrote to memory of 4512 3860 4016.tmp 95 PID 4512 wrote to memory of 688 4512 4083.tmp 96 PID 4512 wrote to memory of 688 4512 4083.tmp 96 PID 4512 wrote to memory of 688 4512 4083.tmp 96 PID 688 wrote to memory of 4760 688 40E1.tmp 97 PID 688 wrote to memory of 4760 688 40E1.tmp 97 PID 688 wrote to memory of 4760 688 40E1.tmp 97 PID 4760 wrote to memory of 2996 4760 412F.tmp 98 PID 4760 wrote to memory of 2996 4760 412F.tmp 98 PID 4760 wrote to memory of 2996 4760 412F.tmp 98 PID 2996 wrote to memory of 3712 2996 419D.tmp 99 PID 2996 wrote to memory of 3712 2996 419D.tmp 99 PID 2996 wrote to memory of 3712 2996 419D.tmp 99 PID 3712 wrote to memory of 2176 3712 420A.tmp 100 PID 3712 wrote to memory of 2176 3712 420A.tmp 100 PID 3712 wrote to memory of 2176 3712 420A.tmp 100 PID 2176 wrote to memory of 2400 2176 4277.tmp 101 PID 2176 wrote to memory of 2400 2176 4277.tmp 101 PID 2176 wrote to memory of 2400 2176 4277.tmp 101 PID 2400 wrote to memory of 4544 2400 42D5.tmp 102 PID 2400 wrote to memory of 4544 2400 42D5.tmp 102 PID 2400 wrote to memory of 4544 2400 42D5.tmp 102 PID 4544 wrote to memory of 436 4544 4343.tmp 103 PID 4544 wrote to memory of 436 4544 4343.tmp 103 PID 4544 wrote to memory of 436 4544 4343.tmp 103 PID 436 wrote to memory of 4516 436 43B0.tmp 104 PID 436 wrote to memory of 4516 436 43B0.tmp 104 PID 436 wrote to memory of 4516 436 43B0.tmp 104 PID 4516 wrote to memory of 2020 4516 440E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"23⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"24⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"25⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"26⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"27⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"28⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"29⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"30⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"31⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"32⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"33⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"34⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"35⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"36⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"37⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"38⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"39⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"40⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"41⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"42⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"43⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"44⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"45⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"46⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"47⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"48⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"49⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"50⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"51⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"52⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"53⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"54⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"55⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"56⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"57⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"58⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"59⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"60⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"61⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"62⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"63⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"64⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"65⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"66⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"67⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"68⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"69⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"70⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"71⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"73⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"74⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"75⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"76⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"78⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"79⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"80⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"81⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"82⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"83⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"84⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"85⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"86⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"87⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"88⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"89⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"90⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"91⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"92⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"93⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"94⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"95⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"96⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"97⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"98⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"99⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"100⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"101⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"102⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"103⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"104⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"105⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"106⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"107⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"108⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"109⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"110⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"111⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"112⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"113⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"114⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"115⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"116⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"117⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"118⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"119⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"120⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"121⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-