Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe
-
Size
529KB
-
MD5
ced8775aea5e0a3c4ece9ca53daba027
-
SHA1
95712444d5df76a08977be22fa4b0aa96b8973cd
-
SHA256
05c38249a207f1b8b5dd25523a6790d9e422c041341f2f0845c104de3dec5cf1
-
SHA512
5a2c3480b7ff0a68cea8f894bba039aa3be6427ad04d6413319f978e906900d21f8dc8c99502c45051e5a30741ee18468f1cca2f31ca23e2d45b303ff387bd75
-
SSDEEP
12288:NU5rCOTeijx41bOX0KSf1xkOPHqWTZwlH4Hp:NUQOJjx41bK2fTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2720 470B.tmp 5024 47A8.tmp 2668 4834.tmp 2728 48D0.tmp 3956 495D.tmp 3656 49CA.tmp 540 4A28.tmp 1140 4AB5.tmp 3300 4B41.tmp 1348 4BBE.tmp 3784 4C1C.tmp 2852 4C6A.tmp 4976 4CE7.tmp 1444 4D35.tmp 440 4D93.tmp 3508 4E10.tmp 3144 4E7E.tmp 4828 4ECC.tmp 1676 4F29.tmp 1720 4F97.tmp 3568 4FE5.tmp 2480 5033.tmp 2904 50B0.tmp 4048 510E.tmp 2244 516C.tmp 4580 51E9.tmp 4244 5266.tmp 2380 52C3.tmp 4500 5321.tmp 4100 537F.tmp 1636 53FC.tmp 464 544A.tmp 3776 54D7.tmp 1184 5534.tmp 3772 55C1.tmp 3308 561F.tmp 544 567C.tmp 3684 56DA.tmp 1992 5728.tmp 3664 5786.tmp 2724 57E4.tmp 4660 5832.tmp 2012 5880.tmp 1772 58DE.tmp 4956 592C.tmp 4700 597A.tmp 1648 59C8.tmp 208 5A16.tmp 4356 5A74.tmp 4328 5AC2.tmp 1856 5B20.tmp 4364 5B7E.tmp 5080 5BCC.tmp 3880 5C2A.tmp 4588 5C78.tmp 3168 5CC6.tmp 556 5D24.tmp 2328 5D81.tmp 3200 5DCF.tmp 3524 5E1E.tmp 3056 5E7B.tmp 2256 5EC9.tmp 948 5F18.tmp 1208 5F75.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 2720 452 2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe 83 PID 452 wrote to memory of 2720 452 2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe 83 PID 452 wrote to memory of 2720 452 2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe 83 PID 2720 wrote to memory of 5024 2720 470B.tmp 86 PID 2720 wrote to memory of 5024 2720 470B.tmp 86 PID 2720 wrote to memory of 5024 2720 470B.tmp 86 PID 5024 wrote to memory of 2668 5024 47A8.tmp 87 PID 5024 wrote to memory of 2668 5024 47A8.tmp 87 PID 5024 wrote to memory of 2668 5024 47A8.tmp 87 PID 2668 wrote to memory of 2728 2668 4834.tmp 88 PID 2668 wrote to memory of 2728 2668 4834.tmp 88 PID 2668 wrote to memory of 2728 2668 4834.tmp 88 PID 2728 wrote to memory of 3956 2728 48D0.tmp 89 PID 2728 wrote to memory of 3956 2728 48D0.tmp 89 PID 2728 wrote to memory of 3956 2728 48D0.tmp 89 PID 3956 wrote to memory of 3656 3956 495D.tmp 90 PID 3956 wrote to memory of 3656 3956 495D.tmp 90 PID 3956 wrote to memory of 3656 3956 495D.tmp 90 PID 3656 wrote to memory of 540 3656 49CA.tmp 91 PID 3656 wrote to memory of 540 3656 49CA.tmp 91 PID 3656 wrote to memory of 540 3656 49CA.tmp 91 PID 540 wrote to memory of 1140 540 4A28.tmp 92 PID 540 wrote to memory of 1140 540 4A28.tmp 92 PID 540 wrote to memory of 1140 540 4A28.tmp 92 PID 1140 wrote to memory of 3300 1140 4AB5.tmp 93 PID 1140 wrote to memory of 3300 1140 4AB5.tmp 93 PID 1140 wrote to memory of 3300 1140 4AB5.tmp 93 PID 3300 wrote to memory of 1348 3300 4B41.tmp 94 PID 3300 wrote to memory of 1348 3300 4B41.tmp 94 PID 3300 wrote to memory of 1348 3300 4B41.tmp 94 PID 1348 wrote to memory of 3784 1348 4BBE.tmp 95 PID 1348 wrote to memory of 3784 1348 4BBE.tmp 95 PID 1348 wrote to memory of 3784 1348 4BBE.tmp 95 PID 3784 wrote to memory of 2852 3784 4C1C.tmp 96 PID 3784 wrote to memory of 2852 3784 4C1C.tmp 96 PID 3784 wrote to memory of 2852 3784 4C1C.tmp 96 PID 2852 wrote to memory of 4976 2852 4C6A.tmp 98 PID 2852 wrote to memory of 4976 2852 4C6A.tmp 98 PID 2852 wrote to memory of 4976 2852 4C6A.tmp 98 PID 4976 wrote to memory of 1444 4976 4CE7.tmp 99 PID 4976 wrote to memory of 1444 4976 4CE7.tmp 99 PID 4976 wrote to memory of 1444 4976 4CE7.tmp 99 PID 1444 wrote to memory of 440 1444 4D35.tmp 100 PID 1444 wrote to memory of 440 1444 4D35.tmp 100 PID 1444 wrote to memory of 440 1444 4D35.tmp 100 PID 440 wrote to memory of 3508 440 4D93.tmp 101 PID 440 wrote to memory of 3508 440 4D93.tmp 101 PID 440 wrote to memory of 3508 440 4D93.tmp 101 PID 3508 wrote to memory of 3144 3508 4E10.tmp 102 PID 3508 wrote to memory of 3144 3508 4E10.tmp 102 PID 3508 wrote to memory of 3144 3508 4E10.tmp 102 PID 3144 wrote to memory of 4828 3144 4E7E.tmp 103 PID 3144 wrote to memory of 4828 3144 4E7E.tmp 103 PID 3144 wrote to memory of 4828 3144 4E7E.tmp 103 PID 4828 wrote to memory of 1676 4828 4ECC.tmp 104 PID 4828 wrote to memory of 1676 4828 4ECC.tmp 104 PID 4828 wrote to memory of 1676 4828 4ECC.tmp 104 PID 1676 wrote to memory of 1720 1676 4F29.tmp 105 PID 1676 wrote to memory of 1720 1676 4F29.tmp 105 PID 1676 wrote to memory of 1720 1676 4F29.tmp 105 PID 1720 wrote to memory of 3568 1720 4F97.tmp 106 PID 1720 wrote to memory of 3568 1720 4F97.tmp 106 PID 1720 wrote to memory of 3568 1720 4F97.tmp 106 PID 3568 wrote to memory of 2480 3568 4FE5.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_ced8775aea5e0a3c4ece9ca53daba027_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"23⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"24⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"25⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"26⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"27⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"28⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"29⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"30⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"31⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"32⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"33⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"34⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"35⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"36⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"37⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"38⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"39⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"40⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"41⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"42⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"43⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"44⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"45⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"46⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"47⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"48⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"49⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"50⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"51⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"52⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"53⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"54⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"55⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"56⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"57⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"58⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"59⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"60⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"61⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"62⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"64⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"65⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"67⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"68⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"69⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"70⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"71⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"72⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"73⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"74⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"75⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"76⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"77⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"78⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"80⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"81⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"82⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"83⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"84⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"85⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"86⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"87⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"88⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"89⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"90⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"91⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"92⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"93⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"94⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"95⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"96⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"97⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"98⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"99⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"100⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"101⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"102⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"103⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"104⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"105⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"106⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"107⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"108⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"109⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"110⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"111⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"112⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"113⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"114⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"115⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"116⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"117⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"118⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"119⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"120⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"121⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"122⤵PID:4056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-