Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
-
Size
529KB
-
MD5
116dc5cbe4af41a83c9d0051ecc3e029
-
SHA1
0c0dda5493fde03da670da425108c84d145f9165
-
SHA256
5bbb5f1180e68358e79b09ede1953357555eacf36789de361815219e69d6db3d
-
SHA512
e2dd1c17cbdb9f84a7805cffb4a4d5c941450d9e907969400e28ff403ccedfe767a4a2191340ef77ee9a12c50587aa9f1befee96b2c383f4350c5d134ded94a6
-
SSDEEP
12288:NU5rCOTeijkEf/+jW92OugK+4z89QhGL3rTZwlH4Hp:NUQOJjkK92OuPz89QEfTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3080 4537.tmp 4160 45B4.tmp 4172 4631.tmp 3500 46AE.tmp 4324 474A.tmp 3848 47B7.tmp 1500 4844.tmp 2032 48C1.tmp 3384 495D.tmp 3780 49CA.tmp 1036 4A38.tmp 3772 4AC4.tmp 3412 4B22.tmp 3640 4B80.tmp 2440 4C0D.tmp 380 4C6A.tmp 1952 4CE7.tmp 2768 4D74.tmp 3084 4DD2.tmp 5024 4E2F.tmp 5052 4EBC.tmp 1496 4F29.tmp 116 4FA6.tmp 3268 5033.tmp 1360 50B0.tmp 3680 513D.tmp 4248 51BA.tmp 3804 5208.tmp 3180 5266.tmp 1336 52E3.tmp 2604 5350.tmp 532 53CD.tmp 4400 544A.tmp 3348 5498.tmp 4088 54E6.tmp 2348 5544.tmp 3756 55B1.tmp 2832 560F.tmp 4584 565D.tmp 2296 56BB.tmp 4476 5719.tmp 1544 5776.tmp 2708 57D4.tmp 4292 5832.tmp 3612 5890.tmp 900 58ED.tmp 4568 594B.tmp 4912 59A9.tmp 1776 5A07.tmp 976 5A64.tmp 4616 5AC2.tmp 3012 5B20.tmp 656 5B7E.tmp 996 5BDB.tmp 2540 5C39.tmp 2656 5C97.tmp 2760 5CE5.tmp 2648 5D43.tmp 3900 5DA1.tmp 2236 5DFE.tmp 2032 5E5C.tmp 3384 5EBA.tmp 4848 5F18.tmp 1220 5F75.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 3080 3668 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 84 PID 3668 wrote to memory of 3080 3668 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 84 PID 3668 wrote to memory of 3080 3668 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 84 PID 3080 wrote to memory of 4160 3080 4537.tmp 85 PID 3080 wrote to memory of 4160 3080 4537.tmp 85 PID 3080 wrote to memory of 4160 3080 4537.tmp 85 PID 4160 wrote to memory of 4172 4160 45B4.tmp 86 PID 4160 wrote to memory of 4172 4160 45B4.tmp 86 PID 4160 wrote to memory of 4172 4160 45B4.tmp 86 PID 4172 wrote to memory of 3500 4172 4631.tmp 87 PID 4172 wrote to memory of 3500 4172 4631.tmp 87 PID 4172 wrote to memory of 3500 4172 4631.tmp 87 PID 3500 wrote to memory of 4324 3500 46AE.tmp 90 PID 3500 wrote to memory of 4324 3500 46AE.tmp 90 PID 3500 wrote to memory of 4324 3500 46AE.tmp 90 PID 4324 wrote to memory of 3848 4324 474A.tmp 91 PID 4324 wrote to memory of 3848 4324 474A.tmp 91 PID 4324 wrote to memory of 3848 4324 474A.tmp 91 PID 3848 wrote to memory of 1500 3848 47B7.tmp 93 PID 3848 wrote to memory of 1500 3848 47B7.tmp 93 PID 3848 wrote to memory of 1500 3848 47B7.tmp 93 PID 1500 wrote to memory of 2032 1500 4844.tmp 94 PID 1500 wrote to memory of 2032 1500 4844.tmp 94 PID 1500 wrote to memory of 2032 1500 4844.tmp 94 PID 2032 wrote to memory of 3384 2032 48C1.tmp 95 PID 2032 wrote to memory of 3384 2032 48C1.tmp 95 PID 2032 wrote to memory of 3384 2032 48C1.tmp 95 PID 3384 wrote to memory of 3780 3384 495D.tmp 96 PID 3384 wrote to memory of 3780 3384 495D.tmp 96 PID 3384 wrote to memory of 3780 3384 495D.tmp 96 PID 3780 wrote to memory of 1036 3780 49CA.tmp 97 PID 3780 wrote to memory of 1036 3780 49CA.tmp 97 PID 3780 wrote to memory of 1036 3780 49CA.tmp 97 PID 1036 wrote to memory of 3772 1036 4A38.tmp 98 PID 1036 wrote to memory of 3772 1036 4A38.tmp 98 PID 1036 wrote to memory of 3772 1036 4A38.tmp 98 PID 3772 wrote to memory of 3412 3772 4AC4.tmp 99 PID 3772 wrote to memory of 3412 3772 4AC4.tmp 99 PID 3772 wrote to memory of 3412 3772 4AC4.tmp 99 PID 3412 wrote to memory of 3640 3412 4B22.tmp 100 PID 3412 wrote to memory of 3640 3412 4B22.tmp 100 PID 3412 wrote to memory of 3640 3412 4B22.tmp 100 PID 3640 wrote to memory of 2440 3640 4B80.tmp 101 PID 3640 wrote to memory of 2440 3640 4B80.tmp 101 PID 3640 wrote to memory of 2440 3640 4B80.tmp 101 PID 2440 wrote to memory of 380 2440 4C0D.tmp 102 PID 2440 wrote to memory of 380 2440 4C0D.tmp 102 PID 2440 wrote to memory of 380 2440 4C0D.tmp 102 PID 380 wrote to memory of 1952 380 4C6A.tmp 103 PID 380 wrote to memory of 1952 380 4C6A.tmp 103 PID 380 wrote to memory of 1952 380 4C6A.tmp 103 PID 1952 wrote to memory of 2768 1952 4CE7.tmp 104 PID 1952 wrote to memory of 2768 1952 4CE7.tmp 104 PID 1952 wrote to memory of 2768 1952 4CE7.tmp 104 PID 2768 wrote to memory of 3084 2768 4D74.tmp 105 PID 2768 wrote to memory of 3084 2768 4D74.tmp 105 PID 2768 wrote to memory of 3084 2768 4D74.tmp 105 PID 3084 wrote to memory of 5024 3084 4DD2.tmp 106 PID 3084 wrote to memory of 5024 3084 4DD2.tmp 106 PID 3084 wrote to memory of 5024 3084 4DD2.tmp 106 PID 5024 wrote to memory of 5052 5024 4E2F.tmp 107 PID 5024 wrote to memory of 5052 5024 4E2F.tmp 107 PID 5024 wrote to memory of 5052 5024 4E2F.tmp 107 PID 5052 wrote to memory of 1496 5052 4EBC.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"23⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"24⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"25⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"26⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"27⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"28⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"29⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"30⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"31⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"32⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"33⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"34⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"35⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"36⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"37⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"38⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"39⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"40⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"41⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"42⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"43⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"44⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"45⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"46⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"47⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"48⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"49⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"50⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"51⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"52⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"53⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"54⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"55⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"56⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"57⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"58⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"59⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"60⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"61⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"62⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"63⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"64⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"65⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"66⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"67⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"68⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"69⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"70⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"71⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"72⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"73⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"74⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"75⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"76⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"77⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"78⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"79⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"80⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"81⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"82⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"83⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"84⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"85⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"86⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"87⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"88⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"89⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"90⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"92⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"93⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"94⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"95⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"96⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"97⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"98⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"99⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"100⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"101⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"102⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"103⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"104⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"106⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"107⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"108⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"109⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"110⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"111⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"112⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"113⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"114⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"115⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"116⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"117⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"118⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"119⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"120⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"121⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-