Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe
-
Size
520KB
-
MD5
cd83bf58516523453f3aeb1cde183dde
-
SHA1
190e69dc339c80a08cb680bed46f53ce419949e9
-
SHA256
3c3c2d88a1e8232fd41e2498bf3eafde5974260bfab9cf9782b0f9b38084522b
-
SHA512
ad4e3dafb7d420d89f3f137093e67dac926482698f18e2e522ea2d71b817b3188a1c9b5a1419d1cb285d1f34fc99e44b9457287fa7c135e1391fea0c5fd6223e
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLclaZ/9aK4SdCRaW6GbOJgZIl7F4jFtnIi8ZeE:roRXOQjmOyMlw9aZSWNBbUitYQEJTNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1512 4537.tmp 1396 45E2.tmp 4032 466F.tmp 3948 46FC.tmp 2904 4788.tmp 1440 4815.tmp 1608 48B1.tmp 4388 492E.tmp 2704 49AB.tmp 4700 4A47.tmp 1896 4AF3.tmp 3532 4B61.tmp 4352 4BCE.tmp 2656 4C5B.tmp 1744 4CC8.tmp 2312 4D35.tmp 4868 4DD2.tmp 4100 4E4F.tmp 2896 4EBC.tmp 4260 4F29.tmp 2856 4FB6.tmp 1168 5014.tmp 4640 5091.tmp 1536 511D.tmp 3492 51BA.tmp 4360 5237.tmp 3812 52B4.tmp 4228 5331.tmp 3084 539E.tmp 4484 540B.tmp 5004 5498.tmp 920 5534.tmp 4816 55F0.tmp 4340 564E.tmp 4416 56AB.tmp 700 5709.tmp 1280 5757.tmp 4636 57D4.tmp 4392 5832.tmp 968 5890.tmp 2304 58FD.tmp 4924 595B.tmp 1608 59B9.tmp 3020 5A07.tmp 768 5A55.tmp 4388 5AA3.tmp 3924 5AF1.tmp 5028 5B4F.tmp 4580 5B9D.tmp 3796 5BEB.tmp 2016 5C39.tmp 1148 5C97.tmp 1160 5CF5.tmp 864 5D43.tmp 428 5D91.tmp 4868 5DEF.tmp 2032 5E3D.tmp 4912 5E9B.tmp 2072 5EF8.tmp 976 5F56.tmp 1760 5FC3.tmp 2200 6031.tmp 1168 607F.tmp 220 60DD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 1512 4416 2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe 83 PID 4416 wrote to memory of 1512 4416 2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe 83 PID 4416 wrote to memory of 1512 4416 2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe 83 PID 1512 wrote to memory of 1396 1512 4537.tmp 84 PID 1512 wrote to memory of 1396 1512 4537.tmp 84 PID 1512 wrote to memory of 1396 1512 4537.tmp 84 PID 1396 wrote to memory of 4032 1396 45E2.tmp 85 PID 1396 wrote to memory of 4032 1396 45E2.tmp 85 PID 1396 wrote to memory of 4032 1396 45E2.tmp 85 PID 4032 wrote to memory of 3948 4032 466F.tmp 86 PID 4032 wrote to memory of 3948 4032 466F.tmp 86 PID 4032 wrote to memory of 3948 4032 466F.tmp 86 PID 3948 wrote to memory of 2904 3948 46FC.tmp 87 PID 3948 wrote to memory of 2904 3948 46FC.tmp 87 PID 3948 wrote to memory of 2904 3948 46FC.tmp 87 PID 2904 wrote to memory of 1440 2904 4788.tmp 89 PID 2904 wrote to memory of 1440 2904 4788.tmp 89 PID 2904 wrote to memory of 1440 2904 4788.tmp 89 PID 1440 wrote to memory of 1608 1440 4815.tmp 91 PID 1440 wrote to memory of 1608 1440 4815.tmp 91 PID 1440 wrote to memory of 1608 1440 4815.tmp 91 PID 1608 wrote to memory of 4388 1608 48B1.tmp 92 PID 1608 wrote to memory of 4388 1608 48B1.tmp 92 PID 1608 wrote to memory of 4388 1608 48B1.tmp 92 PID 4388 wrote to memory of 2704 4388 492E.tmp 94 PID 4388 wrote to memory of 2704 4388 492E.tmp 94 PID 4388 wrote to memory of 2704 4388 492E.tmp 94 PID 2704 wrote to memory of 4700 2704 49AB.tmp 95 PID 2704 wrote to memory of 4700 2704 49AB.tmp 95 PID 2704 wrote to memory of 4700 2704 49AB.tmp 95 PID 4700 wrote to memory of 1896 4700 4A47.tmp 96 PID 4700 wrote to memory of 1896 4700 4A47.tmp 96 PID 4700 wrote to memory of 1896 4700 4A47.tmp 96 PID 1896 wrote to memory of 3532 1896 4AF3.tmp 97 PID 1896 wrote to memory of 3532 1896 4AF3.tmp 97 PID 1896 wrote to memory of 3532 1896 4AF3.tmp 97 PID 3532 wrote to memory of 4352 3532 4B61.tmp 98 PID 3532 wrote to memory of 4352 3532 4B61.tmp 98 PID 3532 wrote to memory of 4352 3532 4B61.tmp 98 PID 4352 wrote to memory of 2656 4352 4BCE.tmp 99 PID 4352 wrote to memory of 2656 4352 4BCE.tmp 99 PID 4352 wrote to memory of 2656 4352 4BCE.tmp 99 PID 2656 wrote to memory of 1744 2656 4C5B.tmp 100 PID 2656 wrote to memory of 1744 2656 4C5B.tmp 100 PID 2656 wrote to memory of 1744 2656 4C5B.tmp 100 PID 1744 wrote to memory of 2312 1744 4CC8.tmp 101 PID 1744 wrote to memory of 2312 1744 4CC8.tmp 101 PID 1744 wrote to memory of 2312 1744 4CC8.tmp 101 PID 2312 wrote to memory of 4868 2312 4D35.tmp 102 PID 2312 wrote to memory of 4868 2312 4D35.tmp 102 PID 2312 wrote to memory of 4868 2312 4D35.tmp 102 PID 4868 wrote to memory of 4100 4868 4DD2.tmp 103 PID 4868 wrote to memory of 4100 4868 4DD2.tmp 103 PID 4868 wrote to memory of 4100 4868 4DD2.tmp 103 PID 4100 wrote to memory of 2896 4100 4E4F.tmp 104 PID 4100 wrote to memory of 2896 4100 4E4F.tmp 104 PID 4100 wrote to memory of 2896 4100 4E4F.tmp 104 PID 2896 wrote to memory of 4260 2896 4EBC.tmp 105 PID 2896 wrote to memory of 4260 2896 4EBC.tmp 105 PID 2896 wrote to memory of 4260 2896 4EBC.tmp 105 PID 4260 wrote to memory of 2856 4260 4F29.tmp 106 PID 4260 wrote to memory of 2856 4260 4F29.tmp 106 PID 4260 wrote to memory of 2856 4260 4F29.tmp 106 PID 2856 wrote to memory of 1168 2856 4FB6.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_cd83bf58516523453f3aeb1cde183dde_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"23⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"24⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"25⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"26⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"27⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"28⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"29⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"30⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"31⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"32⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"33⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"34⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"35⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"36⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"37⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"38⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"39⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"40⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"41⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"42⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"43⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"44⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"45⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"46⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"47⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"48⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"49⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"50⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"51⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"52⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"53⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"54⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"55⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"56⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"57⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"58⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"59⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"60⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"61⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"62⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"63⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"64⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"65⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"66⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"67⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"68⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"69⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"70⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"71⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"72⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"73⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"74⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"75⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"76⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"78⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"79⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"80⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"81⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"82⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"83⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"84⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"85⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"86⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"87⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"88⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"89⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"90⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"91⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"92⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"93⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"94⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"95⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"96⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"97⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"98⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"99⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"100⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"101⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"102⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"103⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"104⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"105⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"106⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"107⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"108⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"109⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"110⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"111⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"112⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"113⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"114⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"115⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"116⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"117⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"118⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"119⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"120⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"121⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"122⤵PID:5068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-