Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe
-
Size
520KB
-
MD5
de77e0b62a6fe3be5eb36904f13e1772
-
SHA1
bade07b46b867cf2f4b965bfaf0a7a1d8979a17d
-
SHA256
80976624460940f5c635ddbfc48d613240adbbc7ee5054ebaa79691f93182dac
-
SHA512
f67b7e7121e24af0feba6226664ecffa76e775fb382920e0f782642a816786d01ac04301307470775ec8834da36b1a5685261c04fa62e572df77aecf34046947
-
SSDEEP
12288:gj8fuxR21t5i8flwiTYnVDVPVwoxLEhlb7yMgy9NZ:gj8fuK1GYDIDVPVwyQbmMgMN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2216 46FC.tmp 696 4759.tmp 1904 47B7.tmp 2828 4815.tmp 1124 4882.tmp 2484 48E0.tmp 3940 492E.tmp 652 498C.tmp 5036 49EA.tmp 2328 4A47.tmp 4216 4AA5.tmp 4864 4AF3.tmp 1032 4B41.tmp 1232 4B90.tmp 488 4C1C.tmp 4588 4C7A.tmp 544 4CD8.tmp 2488 4D35.tmp 2272 4D84.tmp 3504 4DD2.tmp 2176 4E20.tmp 3448 4E7E.tmp 2964 4EDB.tmp 2580 4F29.tmp 4844 4F78.tmp 1692 4FC6.tmp 4404 5023.tmp 2016 5081.tmp 4056 50DF.tmp 3316 513D.tmp 4744 518B.tmp 1820 51D9.tmp 712 5227.tmp 1068 5275.tmp 4508 52C3.tmp 2036 5311.tmp 820 5360.tmp 3388 53CD.tmp 1516 541B.tmp 4528 5469.tmp 3320 54B7.tmp 3688 5505.tmp 1388 5554.tmp 5004 55A2.tmp 2368 55FF.tmp 2004 564E.tmp 3108 56AB.tmp 3336 56F9.tmp 488 5748.tmp 2820 5796.tmp 2304 5822.tmp 4136 58AF.tmp 4016 590D.tmp 3224 596A.tmp 3164 59B9.tmp 3584 5A16.tmp 3228 5A74.tmp 3504 5AD2.tmp 4552 5B20.tmp 3132 5B7E.tmp 2728 5BDB.tmp 2692 5C2A.tmp 2876 5C87.tmp 1016 5CE5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 2216 4820 2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe 83 PID 4820 wrote to memory of 2216 4820 2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe 83 PID 4820 wrote to memory of 2216 4820 2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe 83 PID 2216 wrote to memory of 696 2216 46FC.tmp 84 PID 2216 wrote to memory of 696 2216 46FC.tmp 84 PID 2216 wrote to memory of 696 2216 46FC.tmp 84 PID 696 wrote to memory of 1904 696 4759.tmp 86 PID 696 wrote to memory of 1904 696 4759.tmp 86 PID 696 wrote to memory of 1904 696 4759.tmp 86 PID 1904 wrote to memory of 2828 1904 47B7.tmp 88 PID 1904 wrote to memory of 2828 1904 47B7.tmp 88 PID 1904 wrote to memory of 2828 1904 47B7.tmp 88 PID 2828 wrote to memory of 1124 2828 4815.tmp 90 PID 2828 wrote to memory of 1124 2828 4815.tmp 90 PID 2828 wrote to memory of 1124 2828 4815.tmp 90 PID 1124 wrote to memory of 2484 1124 4882.tmp 91 PID 1124 wrote to memory of 2484 1124 4882.tmp 91 PID 1124 wrote to memory of 2484 1124 4882.tmp 91 PID 2484 wrote to memory of 3940 2484 48E0.tmp 92 PID 2484 wrote to memory of 3940 2484 48E0.tmp 92 PID 2484 wrote to memory of 3940 2484 48E0.tmp 92 PID 3940 wrote to memory of 652 3940 492E.tmp 93 PID 3940 wrote to memory of 652 3940 492E.tmp 93 PID 3940 wrote to memory of 652 3940 492E.tmp 93 PID 652 wrote to memory of 5036 652 498C.tmp 94 PID 652 wrote to memory of 5036 652 498C.tmp 94 PID 652 wrote to memory of 5036 652 498C.tmp 94 PID 5036 wrote to memory of 2328 5036 49EA.tmp 95 PID 5036 wrote to memory of 2328 5036 49EA.tmp 95 PID 5036 wrote to memory of 2328 5036 49EA.tmp 95 PID 2328 wrote to memory of 4216 2328 4A47.tmp 96 PID 2328 wrote to memory of 4216 2328 4A47.tmp 96 PID 2328 wrote to memory of 4216 2328 4A47.tmp 96 PID 4216 wrote to memory of 4864 4216 4AA5.tmp 97 PID 4216 wrote to memory of 4864 4216 4AA5.tmp 97 PID 4216 wrote to memory of 4864 4216 4AA5.tmp 97 PID 4864 wrote to memory of 1032 4864 4AF3.tmp 98 PID 4864 wrote to memory of 1032 4864 4AF3.tmp 98 PID 4864 wrote to memory of 1032 4864 4AF3.tmp 98 PID 1032 wrote to memory of 1232 1032 4B41.tmp 99 PID 1032 wrote to memory of 1232 1032 4B41.tmp 99 PID 1032 wrote to memory of 1232 1032 4B41.tmp 99 PID 1232 wrote to memory of 488 1232 4B90.tmp 101 PID 1232 wrote to memory of 488 1232 4B90.tmp 101 PID 1232 wrote to memory of 488 1232 4B90.tmp 101 PID 488 wrote to memory of 4588 488 4C1C.tmp 102 PID 488 wrote to memory of 4588 488 4C1C.tmp 102 PID 488 wrote to memory of 4588 488 4C1C.tmp 102 PID 4588 wrote to memory of 544 4588 4C7A.tmp 103 PID 4588 wrote to memory of 544 4588 4C7A.tmp 103 PID 4588 wrote to memory of 544 4588 4C7A.tmp 103 PID 544 wrote to memory of 2488 544 4CD8.tmp 104 PID 544 wrote to memory of 2488 544 4CD8.tmp 104 PID 544 wrote to memory of 2488 544 4CD8.tmp 104 PID 2488 wrote to memory of 2272 2488 4D35.tmp 105 PID 2488 wrote to memory of 2272 2488 4D35.tmp 105 PID 2488 wrote to memory of 2272 2488 4D35.tmp 105 PID 2272 wrote to memory of 3504 2272 4D84.tmp 106 PID 2272 wrote to memory of 3504 2272 4D84.tmp 106 PID 2272 wrote to memory of 3504 2272 4D84.tmp 106 PID 3504 wrote to memory of 2176 3504 4DD2.tmp 107 PID 3504 wrote to memory of 2176 3504 4DD2.tmp 107 PID 3504 wrote to memory of 2176 3504 4DD2.tmp 107 PID 2176 wrote to memory of 3448 2176 4E20.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_de77e0b62a6fe3be5eb36904f13e1772_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"23⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"24⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"25⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"26⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"27⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"28⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"29⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"30⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"31⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"32⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"33⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"34⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"35⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"36⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"37⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"38⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"39⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"40⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"41⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"42⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"43⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"44⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"45⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"46⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"47⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"48⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"49⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"50⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"51⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"52⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"53⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"54⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"55⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"56⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"57⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"58⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"59⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"60⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"61⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"62⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"63⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"64⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"65⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"66⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"67⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"68⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"69⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"70⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"71⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"72⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"73⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"74⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"75⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"77⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"78⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"79⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"80⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"81⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"82⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"83⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"84⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"86⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"87⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"88⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"89⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"90⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"91⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"92⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"93⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"95⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"96⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"97⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"98⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"99⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"100⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"101⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"102⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"103⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"104⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"105⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"106⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"107⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"108⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"109⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"110⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"111⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"112⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"113⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"114⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"115⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"116⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"117⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"118⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"119⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"120⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"121⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"122⤵PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-