Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
-
Size
541KB
-
MD5
56d18bfcc4f395d94f00071b454746c0
-
SHA1
78815ef731bcc5116c718d1fb37bcdb141bbc772
-
SHA256
f3afde077b473a91a6718e9db053b501337d13bc8ee6dc6631f71a6218cdbd0f
-
SHA512
a2b54861c1f7f7e78a9b998dba766fcf894070d1523d5097b4d4e635106d95ad9ae66fd8b82f4106887cff288299b0f41fd4004ecd8dd37376ca1afab900ee08
-
SSDEEP
12288:UU5rCOTeifbdVKx/uue8/0MM5HHUS1bzrZa73ctO:UUQOJfK/LeSm5nUS1bzrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1924 495D.tmp 2680 49BB.tmp 1440 4A28.tmp 5064 4AA5.tmp 4932 4B03.tmp 3156 4B80.tmp 4984 4BFD.tmp 1360 4C6A.tmp 1884 4CE7.tmp 4160 4D74.tmp 5036 4E01.tmp 1172 4E8D.tmp 3656 4EEB.tmp 4688 4F49.tmp 1052 4FA6.tmp 1988 5014.tmp 1060 5072.tmp 2536 50CF.tmp 2840 511D.tmp 4140 517B.tmp 2488 5208.tmp 3520 5275.tmp 4980 52F2.tmp 2500 5340.tmp 4740 53BD.tmp 3512 541B.tmp 3408 5479.tmp 4148 54E6.tmp 4184 5544.tmp 2020 55B1.tmp 5024 55FF.tmp 4956 568C.tmp 3260 56F9.tmp 1012 5748.tmp 3568 57A5.tmp 3472 57F3.tmp 852 5842.tmp 4448 589F.tmp 928 58ED.tmp 1440 593C.tmp 2024 598A.tmp 4084 59E7.tmp 4676 5A36.tmp 912 5A93.tmp 4612 5AE1.tmp 764 5B30.tmp 4028 5B8D.tmp 1656 5BCC.tmp 3244 5C1A.tmp 3528 5C68.tmp 3104 5CB6.tmp 2408 5D04.tmp 316 5D52.tmp 2044 5DC0.tmp 4804 5DFE.tmp 2388 5E4C.tmp 3900 5EAA.tmp 3336 5F18.tmp 960 5F66.tmp 2068 5FB4.tmp 4332 6031.tmp 452 607F.tmp 3344 60BD.tmp 4112 611B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1924 1324 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 83 PID 1324 wrote to memory of 1924 1324 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 83 PID 1324 wrote to memory of 1924 1324 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 83 PID 1924 wrote to memory of 2680 1924 495D.tmp 84 PID 1924 wrote to memory of 2680 1924 495D.tmp 84 PID 1924 wrote to memory of 2680 1924 495D.tmp 84 PID 2680 wrote to memory of 1440 2680 49BB.tmp 85 PID 2680 wrote to memory of 1440 2680 49BB.tmp 85 PID 2680 wrote to memory of 1440 2680 49BB.tmp 85 PID 1440 wrote to memory of 5064 1440 4A28.tmp 86 PID 1440 wrote to memory of 5064 1440 4A28.tmp 86 PID 1440 wrote to memory of 5064 1440 4A28.tmp 86 PID 5064 wrote to memory of 4932 5064 4AA5.tmp 88 PID 5064 wrote to memory of 4932 5064 4AA5.tmp 88 PID 5064 wrote to memory of 4932 5064 4AA5.tmp 88 PID 4932 wrote to memory of 3156 4932 4B03.tmp 89 PID 4932 wrote to memory of 3156 4932 4B03.tmp 89 PID 4932 wrote to memory of 3156 4932 4B03.tmp 89 PID 3156 wrote to memory of 4984 3156 4B80.tmp 91 PID 3156 wrote to memory of 4984 3156 4B80.tmp 91 PID 3156 wrote to memory of 4984 3156 4B80.tmp 91 PID 4984 wrote to memory of 1360 4984 4BFD.tmp 92 PID 4984 wrote to memory of 1360 4984 4BFD.tmp 92 PID 4984 wrote to memory of 1360 4984 4BFD.tmp 92 PID 1360 wrote to memory of 1884 1360 4C6A.tmp 93 PID 1360 wrote to memory of 1884 1360 4C6A.tmp 93 PID 1360 wrote to memory of 1884 1360 4C6A.tmp 93 PID 1884 wrote to memory of 4160 1884 4CE7.tmp 94 PID 1884 wrote to memory of 4160 1884 4CE7.tmp 94 PID 1884 wrote to memory of 4160 1884 4CE7.tmp 94 PID 4160 wrote to memory of 5036 4160 4D74.tmp 96 PID 4160 wrote to memory of 5036 4160 4D74.tmp 96 PID 4160 wrote to memory of 5036 4160 4D74.tmp 96 PID 5036 wrote to memory of 1172 5036 4E01.tmp 97 PID 5036 wrote to memory of 1172 5036 4E01.tmp 97 PID 5036 wrote to memory of 1172 5036 4E01.tmp 97 PID 1172 wrote to memory of 3656 1172 4E8D.tmp 98 PID 1172 wrote to memory of 3656 1172 4E8D.tmp 98 PID 1172 wrote to memory of 3656 1172 4E8D.tmp 98 PID 3656 wrote to memory of 4688 3656 4EEB.tmp 99 PID 3656 wrote to memory of 4688 3656 4EEB.tmp 99 PID 3656 wrote to memory of 4688 3656 4EEB.tmp 99 PID 4688 wrote to memory of 1052 4688 4F49.tmp 100 PID 4688 wrote to memory of 1052 4688 4F49.tmp 100 PID 4688 wrote to memory of 1052 4688 4F49.tmp 100 PID 1052 wrote to memory of 1988 1052 4FA6.tmp 101 PID 1052 wrote to memory of 1988 1052 4FA6.tmp 101 PID 1052 wrote to memory of 1988 1052 4FA6.tmp 101 PID 1988 wrote to memory of 1060 1988 5014.tmp 102 PID 1988 wrote to memory of 1060 1988 5014.tmp 102 PID 1988 wrote to memory of 1060 1988 5014.tmp 102 PID 1060 wrote to memory of 2536 1060 5072.tmp 103 PID 1060 wrote to memory of 2536 1060 5072.tmp 103 PID 1060 wrote to memory of 2536 1060 5072.tmp 103 PID 2536 wrote to memory of 2840 2536 50CF.tmp 104 PID 2536 wrote to memory of 2840 2536 50CF.tmp 104 PID 2536 wrote to memory of 2840 2536 50CF.tmp 104 PID 2840 wrote to memory of 4140 2840 511D.tmp 105 PID 2840 wrote to memory of 4140 2840 511D.tmp 105 PID 2840 wrote to memory of 4140 2840 511D.tmp 105 PID 4140 wrote to memory of 2488 4140 517B.tmp 106 PID 4140 wrote to memory of 2488 4140 517B.tmp 106 PID 4140 wrote to memory of 2488 4140 517B.tmp 106 PID 2488 wrote to memory of 3520 2488 5208.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"23⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"24⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"25⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"26⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"27⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"28⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"29⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"30⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"31⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"32⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"33⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"34⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"35⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"36⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"37⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"38⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"39⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"40⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"41⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"42⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"43⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"44⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"45⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"46⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"47⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"48⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"49⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"50⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"51⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"52⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"53⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"54⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"55⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"56⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"57⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"58⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"59⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"60⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"61⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"62⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"63⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"64⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"65⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"66⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"67⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"68⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"69⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"70⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"71⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"72⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"73⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"74⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"75⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"76⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"77⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"78⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"79⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"80⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"81⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"82⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"83⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"84⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"86⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"87⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"88⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"89⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"90⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"91⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"92⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"93⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"94⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"95⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"96⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"97⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"98⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"99⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"100⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"101⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"102⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"103⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"104⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"105⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"106⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"107⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"108⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"109⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"110⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"111⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"112⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"113⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"114⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"115⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"116⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"117⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"118⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"119⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"120⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"121⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"122⤵PID:4768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-