Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe
-
Size
529KB
-
MD5
f1b615c7eff540fe52f947bb6e467421
-
SHA1
828cd5404e9644f5ff20f2d3b19f1ce2180b7598
-
SHA256
a5eb5dae59aa318eadc97cb6cab576b2f02da39f6267481b1c671ef4112324d9
-
SHA512
09e406053722f70aa20c6ebc80c6a98926cb68680d07cb2ad53b39b98addec53afe4f7a7168c142f12749088bb2929fb8fb49a06b94224834cc3b8f4ad22ff90
-
SSDEEP
12288:NU5rCOTeijteaOKMB9a24nO1jokYdTZwlH4Hp:NUQOJjkSMP19YdTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 3DA5.tmp 2216 3E03.tmp 796 3E70.tmp 1880 3ECE.tmp 2936 3F2C.tmp 1436 3FA9.tmp 3036 3FF7.tmp 2908 4055.tmp 1348 40C2.tmp 4800 4120.tmp 1652 417D.tmp 3932 41CC.tmp 5020 4229.tmp 4672 4287.tmp 3636 42D5.tmp 2688 4333.tmp 4480 4391.tmp 3604 43EE.tmp 2672 444C.tmp 3992 449A.tmp 552 44F8.tmp 1704 4556.tmp 5052 45A4.tmp 2956 45F2.tmp 4956 4650.tmp 3936 46BD.tmp 1804 471B.tmp 852 4769.tmp 3264 47B7.tmp 2852 4834.tmp 3608 4892.tmp 1548 48E0.tmp 1176 493E.tmp 4460 498C.tmp 4244 49DA.tmp 100 4A57.tmp 4604 4AD4.tmp 220 4B22.tmp 2972 4BCE.tmp 2340 4C1C.tmp 4128 4C6A.tmp 2348 4CB8.tmp 4552 4D16.tmp 2760 4D64.tmp 5040 4DB2.tmp 4656 4E01.tmp 3452 4E5E.tmp 4588 4E9D.tmp 2168 4EEB.tmp 3892 4F39.tmp 1832 4F97.tmp 1564 4FF5.tmp 4080 5043.tmp 2712 50A0.tmp 4976 50FE.tmp 4948 514C.tmp 1872 519A.tmp 4484 51E9.tmp 1208 5237.tmp 2532 5285.tmp 2716 52C3.tmp 1020 5311.tmp 4304 5360.tmp 3292 53AE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 4720 1792 2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe 83 PID 1792 wrote to memory of 4720 1792 2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe 83 PID 1792 wrote to memory of 4720 1792 2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe 83 PID 4720 wrote to memory of 2216 4720 3DA5.tmp 85 PID 4720 wrote to memory of 2216 4720 3DA5.tmp 85 PID 4720 wrote to memory of 2216 4720 3DA5.tmp 85 PID 2216 wrote to memory of 796 2216 3E03.tmp 87 PID 2216 wrote to memory of 796 2216 3E03.tmp 87 PID 2216 wrote to memory of 796 2216 3E03.tmp 87 PID 796 wrote to memory of 1880 796 3E70.tmp 89 PID 796 wrote to memory of 1880 796 3E70.tmp 89 PID 796 wrote to memory of 1880 796 3E70.tmp 89 PID 1880 wrote to memory of 2936 1880 3ECE.tmp 242 PID 1880 wrote to memory of 2936 1880 3ECE.tmp 242 PID 1880 wrote to memory of 2936 1880 3ECE.tmp 242 PID 2936 wrote to memory of 1436 2936 3F2C.tmp 91 PID 2936 wrote to memory of 1436 2936 3F2C.tmp 91 PID 2936 wrote to memory of 1436 2936 3F2C.tmp 91 PID 1436 wrote to memory of 3036 1436 3FA9.tmp 92 PID 1436 wrote to memory of 3036 1436 3FA9.tmp 92 PID 1436 wrote to memory of 3036 1436 3FA9.tmp 92 PID 3036 wrote to memory of 2908 3036 3FF7.tmp 93 PID 3036 wrote to memory of 2908 3036 3FF7.tmp 93 PID 3036 wrote to memory of 2908 3036 3FF7.tmp 93 PID 2908 wrote to memory of 1348 2908 4055.tmp 94 PID 2908 wrote to memory of 1348 2908 4055.tmp 94 PID 2908 wrote to memory of 1348 2908 4055.tmp 94 PID 1348 wrote to memory of 4800 1348 40C2.tmp 95 PID 1348 wrote to memory of 4800 1348 40C2.tmp 95 PID 1348 wrote to memory of 4800 1348 40C2.tmp 95 PID 4800 wrote to memory of 1652 4800 4120.tmp 96 PID 4800 wrote to memory of 1652 4800 4120.tmp 96 PID 4800 wrote to memory of 1652 4800 4120.tmp 96 PID 1652 wrote to memory of 3932 1652 417D.tmp 249 PID 1652 wrote to memory of 3932 1652 417D.tmp 249 PID 1652 wrote to memory of 3932 1652 417D.tmp 249 PID 3932 wrote to memory of 5020 3932 41CC.tmp 98 PID 3932 wrote to memory of 5020 3932 41CC.tmp 98 PID 3932 wrote to memory of 5020 3932 41CC.tmp 98 PID 5020 wrote to memory of 4672 5020 4229.tmp 99 PID 5020 wrote to memory of 4672 5020 4229.tmp 99 PID 5020 wrote to memory of 4672 5020 4229.tmp 99 PID 4672 wrote to memory of 3636 4672 4287.tmp 100 PID 4672 wrote to memory of 3636 4672 4287.tmp 100 PID 4672 wrote to memory of 3636 4672 4287.tmp 100 PID 3636 wrote to memory of 2688 3636 42D5.tmp 101 PID 3636 wrote to memory of 2688 3636 42D5.tmp 101 PID 3636 wrote to memory of 2688 3636 42D5.tmp 101 PID 2688 wrote to memory of 4480 2688 4333.tmp 102 PID 2688 wrote to memory of 4480 2688 4333.tmp 102 PID 2688 wrote to memory of 4480 2688 4333.tmp 102 PID 4480 wrote to memory of 3604 4480 4391.tmp 103 PID 4480 wrote to memory of 3604 4480 4391.tmp 103 PID 4480 wrote to memory of 3604 4480 4391.tmp 103 PID 3604 wrote to memory of 2672 3604 43EE.tmp 104 PID 3604 wrote to memory of 2672 3604 43EE.tmp 104 PID 3604 wrote to memory of 2672 3604 43EE.tmp 104 PID 2672 wrote to memory of 3992 2672 444C.tmp 107 PID 2672 wrote to memory of 3992 2672 444C.tmp 107 PID 2672 wrote to memory of 3992 2672 444C.tmp 107 PID 3992 wrote to memory of 552 3992 449A.tmp 108 PID 3992 wrote to memory of 552 3992 449A.tmp 108 PID 3992 wrote to memory of 552 3992 449A.tmp 108 PID 552 wrote to memory of 1704 552 44F8.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2511621439\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2511621439\zmstage.exe1⤵PID:220
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_f1b615c7eff540fe52f947bb6e467421_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"23⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"24⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"25⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"26⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"27⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"28⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"29⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"30⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"31⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"32⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"33⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"34⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"35⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"36⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"37⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"38⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"39⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"40⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"41⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"42⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"43⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"44⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"45⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"46⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"47⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"48⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"49⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"50⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"51⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"52⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"53⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"54⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"55⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"56⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"57⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"58⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"59⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"60⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"61⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"62⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"63⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"64⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"65⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"66⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"67⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"68⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"70⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"71⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"72⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"73⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"74⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"75⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"76⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"77⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"78⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"79⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"80⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"81⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"82⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"83⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"84⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"85⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"86⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"87⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"88⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"89⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"90⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"91⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"92⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"93⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"94⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"95⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"96⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"97⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"99⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"100⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"101⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"102⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"103⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"104⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"105⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"106⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"107⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"108⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"109⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"110⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"111⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"112⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"113⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"114⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"115⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"116⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"117⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"118⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"119⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"120⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"121⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"122⤵PID:4328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-