Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe
-
Size
536KB
-
MD5
cd3fac9f26237da379418c91ddc07b1d
-
SHA1
db3983be10b718a42b36735a79cbbfc86dfed903
-
SHA256
df6ed24dbcf44990f97c67f12703349a946d35b1137f43c1a446b15a331c6cb8
-
SHA512
0c27afc6dfcb972fa91d30e62b04c318417fb4a682b977249bd34701f5b26ccc935b51383c5d682b76eecee394ac74ca47b5b99f576934c32e2674028267d34a
-
SSDEEP
12288:wU5rCOTeiUFIETHHDq6JzKNHT1EyKyCyDWNBSXIZxVJ0ZT9:wUQOJUiETDFzMHnKyCWWNBQIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
3289.tmp3354.tmp33F1.tmp350A.tmp35D5.tmp3652.tmp370E.tmp379A.tmp3836.tmp38C3.tmp397F.tmp39EC.tmp3A69.tmp3AE6.tmp3BA1.tmp3C2E.tmp3D09.tmp3DE4.tmp3E8F.tmp3F0C.tmp4006.tmp40B2.tmp415E.tmp41EB.tmp42B6.tmp4333.tmp43B0.tmp444C.tmp44F8.tmp4585.tmp4650.tmp46FC.tmp4798.tmp4805.tmp4873.tmp491F.tmp49AB.tmp4A19.tmp4A96.tmp4B03.tmp4B61.tmp4BED.tmp4C8A.tmp4CD8.tmp4D26.tmp4D84.tmp4DF1.tmp4E7E.tmp4EEB.tmp4F39.tmp4FA6.tmp5004.tmp5062.tmp50B0.tmp512D.tmp518B.tmp51E9.tmp5237.tmp5294.tmp52E3.tmp5331.tmp537F.tmp53CD.tmp542B.tmppid process 2720 3289.tmp 3496 3354.tmp 3772 33F1.tmp 3572 350A.tmp 4900 35D5.tmp 1348 3652.tmp 2864 370E.tmp 3460 379A.tmp 4468 3836.tmp 2108 38C3.tmp 4544 397F.tmp 1872 39EC.tmp 4256 3A69.tmp 532 3AE6.tmp 316 3BA1.tmp 4072 3C2E.tmp 4088 3D09.tmp 988 3DE4.tmp 4972 3E8F.tmp 3236 3F0C.tmp 4356 4006.tmp 2464 40B2.tmp 5016 415E.tmp 4484 41EB.tmp 1428 42B6.tmp 3604 4333.tmp 2500 43B0.tmp 1684 444C.tmp 4800 44F8.tmp 864 4585.tmp 1256 4650.tmp 2448 46FC.tmp 3572 4798.tmp 3388 4805.tmp 3632 4873.tmp 3744 491F.tmp 4232 49AB.tmp 808 4A19.tmp 3120 4A96.tmp 2028 4B03.tmp 1344 4B61.tmp 4024 4BED.tmp 684 4C8A.tmp 2056 4CD8.tmp 2452 4D26.tmp 4256 4D84.tmp 464 4DF1.tmp 3584 4E7E.tmp 1508 4EEB.tmp 4384 4F39.tmp 4976 4FA6.tmp 2576 5004.tmp 4744 5062.tmp 3912 50B0.tmp 5076 512D.tmp 3512 518B.tmp 2692 51E9.tmp 1152 5237.tmp 4680 5294.tmp 2116 52E3.tmp 3540 5331.tmp 3604 537F.tmp 2016 53CD.tmp 2720 542B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe3289.tmp3354.tmp33F1.tmp350A.tmp35D5.tmp3652.tmp370E.tmp379A.tmp3836.tmp38C3.tmp397F.tmp39EC.tmp3A69.tmp3AE6.tmp3BA1.tmp3C2E.tmp3D09.tmp3DE4.tmp3E8F.tmp3F0C.tmp4006.tmpdescription pid process target process PID 3196 wrote to memory of 2720 3196 2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe 3289.tmp PID 3196 wrote to memory of 2720 3196 2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe 3289.tmp PID 3196 wrote to memory of 2720 3196 2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe 3289.tmp PID 2720 wrote to memory of 3496 2720 3289.tmp 3354.tmp PID 2720 wrote to memory of 3496 2720 3289.tmp 3354.tmp PID 2720 wrote to memory of 3496 2720 3289.tmp 3354.tmp PID 3496 wrote to memory of 3772 3496 3354.tmp 33F1.tmp PID 3496 wrote to memory of 3772 3496 3354.tmp 33F1.tmp PID 3496 wrote to memory of 3772 3496 3354.tmp 33F1.tmp PID 3772 wrote to memory of 3572 3772 33F1.tmp 350A.tmp PID 3772 wrote to memory of 3572 3772 33F1.tmp 350A.tmp PID 3772 wrote to memory of 3572 3772 33F1.tmp 350A.tmp PID 3572 wrote to memory of 4900 3572 350A.tmp 35D5.tmp PID 3572 wrote to memory of 4900 3572 350A.tmp 35D5.tmp PID 3572 wrote to memory of 4900 3572 350A.tmp 35D5.tmp PID 4900 wrote to memory of 1348 4900 35D5.tmp 3652.tmp PID 4900 wrote to memory of 1348 4900 35D5.tmp 3652.tmp PID 4900 wrote to memory of 1348 4900 35D5.tmp 3652.tmp PID 1348 wrote to memory of 2864 1348 3652.tmp 370E.tmp PID 1348 wrote to memory of 2864 1348 3652.tmp 370E.tmp PID 1348 wrote to memory of 2864 1348 3652.tmp 370E.tmp PID 2864 wrote to memory of 3460 2864 370E.tmp 379A.tmp PID 2864 wrote to memory of 3460 2864 370E.tmp 379A.tmp PID 2864 wrote to memory of 3460 2864 370E.tmp 379A.tmp PID 3460 wrote to memory of 4468 3460 379A.tmp 3836.tmp PID 3460 wrote to memory of 4468 3460 379A.tmp 3836.tmp PID 3460 wrote to memory of 4468 3460 379A.tmp 3836.tmp PID 4468 wrote to memory of 2108 4468 3836.tmp 38C3.tmp PID 4468 wrote to memory of 2108 4468 3836.tmp 38C3.tmp PID 4468 wrote to memory of 2108 4468 3836.tmp 38C3.tmp PID 2108 wrote to memory of 4544 2108 38C3.tmp 397F.tmp PID 2108 wrote to memory of 4544 2108 38C3.tmp 397F.tmp PID 2108 wrote to memory of 4544 2108 38C3.tmp 397F.tmp PID 4544 wrote to memory of 1872 4544 397F.tmp 39EC.tmp PID 4544 wrote to memory of 1872 4544 397F.tmp 39EC.tmp PID 4544 wrote to memory of 1872 4544 397F.tmp 39EC.tmp PID 1872 wrote to memory of 4256 1872 39EC.tmp 3A69.tmp PID 1872 wrote to memory of 4256 1872 39EC.tmp 3A69.tmp PID 1872 wrote to memory of 4256 1872 39EC.tmp 3A69.tmp PID 4256 wrote to memory of 532 4256 3A69.tmp 3AE6.tmp PID 4256 wrote to memory of 532 4256 3A69.tmp 3AE6.tmp PID 4256 wrote to memory of 532 4256 3A69.tmp 3AE6.tmp PID 532 wrote to memory of 316 532 3AE6.tmp 3BA1.tmp PID 532 wrote to memory of 316 532 3AE6.tmp 3BA1.tmp PID 532 wrote to memory of 316 532 3AE6.tmp 3BA1.tmp PID 316 wrote to memory of 4072 316 3BA1.tmp 3C2E.tmp PID 316 wrote to memory of 4072 316 3BA1.tmp 3C2E.tmp PID 316 wrote to memory of 4072 316 3BA1.tmp 3C2E.tmp PID 4072 wrote to memory of 4088 4072 3C2E.tmp 3D09.tmp PID 4072 wrote to memory of 4088 4072 3C2E.tmp 3D09.tmp PID 4072 wrote to memory of 4088 4072 3C2E.tmp 3D09.tmp PID 4088 wrote to memory of 988 4088 3D09.tmp 3DE4.tmp PID 4088 wrote to memory of 988 4088 3D09.tmp 3DE4.tmp PID 4088 wrote to memory of 988 4088 3D09.tmp 3DE4.tmp PID 988 wrote to memory of 4972 988 3DE4.tmp 3E8F.tmp PID 988 wrote to memory of 4972 988 3DE4.tmp 3E8F.tmp PID 988 wrote to memory of 4972 988 3DE4.tmp 3E8F.tmp PID 4972 wrote to memory of 3236 4972 3E8F.tmp 3F0C.tmp PID 4972 wrote to memory of 3236 4972 3E8F.tmp 3F0C.tmp PID 4972 wrote to memory of 3236 4972 3E8F.tmp 3F0C.tmp PID 3236 wrote to memory of 4356 3236 3F0C.tmp 4006.tmp PID 3236 wrote to memory of 4356 3236 3F0C.tmp 4006.tmp PID 3236 wrote to memory of 4356 3236 3F0C.tmp 4006.tmp PID 4356 wrote to memory of 2464 4356 4006.tmp 40B2.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_cd3fac9f26237da379418c91ddc07b1d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"23⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"24⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"25⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"26⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"27⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"28⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"29⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"30⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"31⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"32⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"33⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"34⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"35⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"36⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"37⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"38⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"39⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"40⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"41⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"42⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"43⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"44⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"45⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"46⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"47⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"48⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"49⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"50⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"51⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"52⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"53⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"54⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"55⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"56⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"57⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"58⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"59⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"60⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"61⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"62⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"63⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"64⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"66⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"67⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"68⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"69⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"70⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"71⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"72⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"73⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"74⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"75⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"76⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"77⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"78⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"79⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"80⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"81⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"82⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"83⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"84⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"85⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"86⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"87⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"88⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"89⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"90⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"91⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"92⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"93⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"94⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"95⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"96⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"98⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"100⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"103⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"104⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"105⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"106⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"107⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"108⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"109⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"110⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"111⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"112⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"113⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"114⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"115⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"116⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"117⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"118⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"119⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"120⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"121⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"122⤵PID:4088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-