Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe
-
Size
488KB
-
MD5
bc2a7f0d8515fa8832a8b3de30005930
-
SHA1
6d866e7c1a193aa863e680929438ea0038cc3e51
-
SHA256
c28b27d025a31d1a047dbcad0190332cf152acb0226d6abd7e914e3cd9d4d6a6
-
SHA512
5eda826f9804d18fcc34ef1be1e08ba0be42aafbfa945f44db8e5bf325aabfa95550cf0548a2c2eb95ac97253232c183784ca4c0010adcb8436a409846e4be19
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7isWfMLqzblBftGlJ6e7J8oeMarXqdevssH3j:/U5rCOTeiDEKq/lBUlHJ2MamdevVNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2824 412F.tmp 4316 419D.tmp 2328 420A.tmp 3208 4277.tmp 4904 42E5.tmp 1276 4362.tmp 2884 43C0.tmp 3256 443D.tmp 1048 44BA.tmp 2100 4527.tmp 1812 4585.tmp 3344 4602.tmp 2792 466F.tmp 5036 46CD.tmp 4876 472B.tmp 4596 4798.tmp 4684 4815.tmp 632 4882.tmp 3164 48E0.tmp 1252 492E.tmp 2288 498C.tmp 4676 49F9.tmp 4800 4A67.tmp 2004 4AD4.tmp 684 4B32.tmp 452 4B9F.tmp 4468 4C1C.tmp 4848 4C99.tmp 396 4D16.tmp 4068 4D74.tmp 3612 4DE1.tmp 4896 4E2F.tmp 3988 4E9D.tmp 5056 4EEB.tmp 1196 4F39.tmp 4384 4F87.tmp 1660 4FD5.tmp 412 5023.tmp 3812 5072.tmp 3436 50CF.tmp 1184 511D.tmp 592 517B.tmp 3208 51C9.tmp 1064 5227.tmp 1568 5285.tmp 2424 52E3.tmp 888 5340.tmp 1768 539E.tmp 4808 53FC.tmp 4992 545A.tmp 1928 54A8.tmp 3348 54F6.tmp 5092 5554.tmp 3012 55A2.tmp 1284 55FF.tmp 4028 565D.tmp 3872 56AB.tmp 1596 5709.tmp 3604 5767.tmp 2388 57B5.tmp 5084 5813.tmp 3548 5861.tmp 2020 58AF.tmp 3276 58FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 2824 1188 2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe 83 PID 1188 wrote to memory of 2824 1188 2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe 83 PID 1188 wrote to memory of 2824 1188 2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe 83 PID 2824 wrote to memory of 4316 2824 412F.tmp 84 PID 2824 wrote to memory of 4316 2824 412F.tmp 84 PID 2824 wrote to memory of 4316 2824 412F.tmp 84 PID 4316 wrote to memory of 2328 4316 419D.tmp 87 PID 4316 wrote to memory of 2328 4316 419D.tmp 87 PID 4316 wrote to memory of 2328 4316 419D.tmp 87 PID 2328 wrote to memory of 3208 2328 420A.tmp 88 PID 2328 wrote to memory of 3208 2328 420A.tmp 88 PID 2328 wrote to memory of 3208 2328 420A.tmp 88 PID 3208 wrote to memory of 4904 3208 4277.tmp 90 PID 3208 wrote to memory of 4904 3208 4277.tmp 90 PID 3208 wrote to memory of 4904 3208 4277.tmp 90 PID 4904 wrote to memory of 1276 4904 42E5.tmp 91 PID 4904 wrote to memory of 1276 4904 42E5.tmp 91 PID 4904 wrote to memory of 1276 4904 42E5.tmp 91 PID 1276 wrote to memory of 2884 1276 4362.tmp 92 PID 1276 wrote to memory of 2884 1276 4362.tmp 92 PID 1276 wrote to memory of 2884 1276 4362.tmp 92 PID 2884 wrote to memory of 3256 2884 43C0.tmp 93 PID 2884 wrote to memory of 3256 2884 43C0.tmp 93 PID 2884 wrote to memory of 3256 2884 43C0.tmp 93 PID 3256 wrote to memory of 1048 3256 443D.tmp 94 PID 3256 wrote to memory of 1048 3256 443D.tmp 94 PID 3256 wrote to memory of 1048 3256 443D.tmp 94 PID 1048 wrote to memory of 2100 1048 44BA.tmp 95 PID 1048 wrote to memory of 2100 1048 44BA.tmp 95 PID 1048 wrote to memory of 2100 1048 44BA.tmp 95 PID 2100 wrote to memory of 1812 2100 4527.tmp 96 PID 2100 wrote to memory of 1812 2100 4527.tmp 96 PID 2100 wrote to memory of 1812 2100 4527.tmp 96 PID 1812 wrote to memory of 3344 1812 4585.tmp 97 PID 1812 wrote to memory of 3344 1812 4585.tmp 97 PID 1812 wrote to memory of 3344 1812 4585.tmp 97 PID 3344 wrote to memory of 2792 3344 4602.tmp 98 PID 3344 wrote to memory of 2792 3344 4602.tmp 98 PID 3344 wrote to memory of 2792 3344 4602.tmp 98 PID 2792 wrote to memory of 5036 2792 466F.tmp 99 PID 2792 wrote to memory of 5036 2792 466F.tmp 99 PID 2792 wrote to memory of 5036 2792 466F.tmp 99 PID 5036 wrote to memory of 4876 5036 46CD.tmp 100 PID 5036 wrote to memory of 4876 5036 46CD.tmp 100 PID 5036 wrote to memory of 4876 5036 46CD.tmp 100 PID 4876 wrote to memory of 4596 4876 472B.tmp 101 PID 4876 wrote to memory of 4596 4876 472B.tmp 101 PID 4876 wrote to memory of 4596 4876 472B.tmp 101 PID 4596 wrote to memory of 4684 4596 4798.tmp 103 PID 4596 wrote to memory of 4684 4596 4798.tmp 103 PID 4596 wrote to memory of 4684 4596 4798.tmp 103 PID 4684 wrote to memory of 632 4684 4815.tmp 104 PID 4684 wrote to memory of 632 4684 4815.tmp 104 PID 4684 wrote to memory of 632 4684 4815.tmp 104 PID 632 wrote to memory of 3164 632 4882.tmp 106 PID 632 wrote to memory of 3164 632 4882.tmp 106 PID 632 wrote to memory of 3164 632 4882.tmp 106 PID 3164 wrote to memory of 1252 3164 48E0.tmp 107 PID 3164 wrote to memory of 1252 3164 48E0.tmp 107 PID 3164 wrote to memory of 1252 3164 48E0.tmp 107 PID 1252 wrote to memory of 2288 1252 492E.tmp 108 PID 1252 wrote to memory of 2288 1252 492E.tmp 108 PID 1252 wrote to memory of 2288 1252 492E.tmp 108 PID 2288 wrote to memory of 4676 2288 498C.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_bc2a7f0d8515fa8832a8b3de30005930_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"23⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"24⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"25⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"26⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"27⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"28⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"29⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"30⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"31⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"32⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"33⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"34⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"35⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"36⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"37⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"38⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"39⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"40⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"41⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"42⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"43⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"44⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"45⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"46⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"47⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"48⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"49⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"50⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"51⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"52⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"53⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"54⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"55⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"56⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"57⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"58⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"59⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"60⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"61⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"62⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"63⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"64⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"65⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"66⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"67⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"68⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"69⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"70⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"71⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"72⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"73⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"74⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"75⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"77⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"78⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"79⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"80⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"81⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"82⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"83⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"84⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"85⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"86⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"87⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"88⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"89⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"90⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"91⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"92⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"93⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"94⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"95⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"96⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"97⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"98⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"99⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"100⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"101⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"103⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"104⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"105⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"106⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"107⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"108⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"109⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"110⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"111⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"112⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"113⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"114⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"115⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"116⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"117⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"118⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"119⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"120⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"121⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"122⤵PID:3320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-