Analysis
- max time kernel
150s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
- Target 2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe
- Size 541KB
- Sample240602-hhgckaee93
- SHA256 29958009f84f6733d22f9a7e11790df9c7abb8d3e77d6ef613f93deb14ca1adc
- MD5 2053e157d1d87ff6067828dca7fd6a99
- SHA1 ae6ffafcf5afec05f6c19ded7e8f5529000a8db6
- SHA512 5467dbd0f0dc9ba02071650421ab90ef1817864f316774958a55867db35bc7ec51365759da15acdb312f69e0882e168ac8cc2e19229ac44c65743162121da1c7
- SSDEEP 12288:UU5rCOTeifUtrn/gAukx4Sw1zoqbgZ053VNcprZa73ctO:UUQOJfQ/WSw1cq8m53VqprU73ctO
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2708 3A69.tmp 1592 3AC7.tmp 1308 3B34.tmp 1560 3BD0.tmp 3812 3C5D.tmp 3028 3CCA.tmp 1960 3D18.tmp 3404 3D76.tmp 4340 3DD4.tmp 3756 3E41.tmp 2576 3E8F.tmp 5040 3EED.tmp 3184 3F5B.tmp 3436 3FC8.tmp 1620 4035.tmp 1988 4083.tmp 4072 40F1.tmp 4452 415E.tmp 3192 41CC.tmp 1776 421A.tmp 1424 4287.tmp 408 42E5.tmp 1576 4343.tmp 2296 4391.tmp 2072 43DF.tmp 1176 445C.tmp 3012 44D9.tmp 5052 4527.tmp 2100 45A4.tmp 2520 4602.tmp 1660 4650.tmp 1628 46AE.tmp 3480 473A.tmp 2320 4788.tmp 832 47D6.tmp 3016 4825.tmp 2200 4873.tmp 3504 48C1.tmp 3784 490F.tmp 464 495D.tmp 2284 49AB.tmp 4476 4A09.tmp 928 4A57.tmp 4436 4AA5.tmp 3000 4AF3.tmp 3984 4B51.tmp 436 4B9F.tmp 3740 4BED.tmp 4156 4C4B.tmp 1364 4CA9.tmp 540 4D07.tmp 4992 4D64.tmp 3308 4DC2.tmp 1132 4E20.tmp 3688 4E6E.tmp 4604 4ECC.tmp 4400 4F29.tmp 1800 4F87.tmp 2908 4FE5.tmp 1788 5043.tmp 4636 50A0.tmp 1700 50FE.tmp 2332 514C.tmp 3088 51AA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2708 3000 2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe 81 PID 3000 wrote to memory of 2708 3000 2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe 81 PID 3000 wrote to memory of 2708 3000 2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe 81 PID 2708 wrote to memory of 1592 2708 3A69.tmp 82 PID 2708 wrote to memory of 1592 2708 3A69.tmp 82 PID 2708 wrote to memory of 1592 2708 3A69.tmp 82 PID 1592 wrote to memory of 1308 1592 3AC7.tmp 84 PID 1592 wrote to memory of 1308 1592 3AC7.tmp 84 PID 1592 wrote to memory of 1308 1592 3AC7.tmp 84 PID 1308 wrote to memory of 1560 1308 3B34.tmp 86 PID 1308 wrote to memory of 1560 1308 3B34.tmp 86 PID 1308 wrote to memory of 1560 1308 3B34.tmp 86 PID 1560 wrote to memory of 3812 1560 3BD0.tmp 88 PID 1560 wrote to memory of 3812 1560 3BD0.tmp 88 PID 1560 wrote to memory of 3812 1560 3BD0.tmp 88 PID 3812 wrote to memory of 3028 3812 3C5D.tmp 89 PID 3812 wrote to memory of 3028 3812 3C5D.tmp 89 PID 3812 wrote to memory of 3028 3812 3C5D.tmp 89 PID 3028 wrote to memory of 1960 3028 3CCA.tmp 90 PID 3028 wrote to memory of 1960 3028 3CCA.tmp 90 PID 3028 wrote to memory of 1960 3028 3CCA.tmp 90 PID 1960 wrote to memory of 3404 1960 3D18.tmp 91 PID 1960 wrote to memory of 3404 1960 3D18.tmp 91 PID 1960 wrote to memory of 3404 1960 3D18.tmp 91 PID 3404 wrote to memory of 4340 3404 3D76.tmp 92 PID 3404 wrote to memory of 4340 3404 3D76.tmp 92 PID 3404 wrote to memory of 4340 3404 3D76.tmp 92 PID 4340 wrote to memory of 3756 4340 3DD4.tmp 93 PID 4340 wrote to memory of 3756 4340 3DD4.tmp 93 PID 4340 wrote to memory of 3756 4340 3DD4.tmp 93 PID 3756 wrote to memory of 2576 3756 3E41.tmp 94 PID 3756 wrote to memory of 2576 3756 3E41.tmp 94 PID 3756 wrote to memory of 2576 3756 3E41.tmp 94 PID 2576 wrote to memory of 5040 2576 3E8F.tmp 95 PID 2576 wrote to memory of 5040 2576 3E8F.tmp 95 PID 2576 wrote to memory of 5040 2576 3E8F.tmp 95 PID 5040 wrote to memory of 3184 5040 3EED.tmp 96 PID 5040 wrote to memory of 3184 5040 3EED.tmp 96 PID 5040 wrote to memory of 3184 5040 3EED.tmp 96 PID 3184 wrote to memory of 3436 3184 3F5B.tmp 97 PID 3184 wrote to memory of 3436 3184 3F5B.tmp 97 PID 3184 wrote to memory of 3436 3184 3F5B.tmp 97 PID 3436 wrote to memory of 1620 3436 3FC8.tmp 98 PID 3436 wrote to memory of 1620 3436 3FC8.tmp 98 PID 3436 wrote to memory of 1620 3436 3FC8.tmp 98 PID 1620 wrote to memory of 1988 1620 4035.tmp 99 PID 1620 wrote to memory of 1988 1620 4035.tmp 99 PID 1620 wrote to memory of 1988 1620 4035.tmp 99 PID 1988 wrote to memory of 4072 1988 4083.tmp 100 PID 1988 wrote to memory of 4072 1988 4083.tmp 100 PID 1988 wrote to memory of 4072 1988 4083.tmp 100 PID 4072 wrote to memory of 4452 4072 40F1.tmp 101 PID 4072 wrote to memory of 4452 4072 40F1.tmp 101 PID 4072 wrote to memory of 4452 4072 40F1.tmp 101 PID 4452 wrote to memory of 3192 4452 415E.tmp 102 PID 4452 wrote to memory of 3192 4452 415E.tmp 102 PID 4452 wrote to memory of 3192 4452 415E.tmp 102 PID 3192 wrote to memory of 1776 3192 41CC.tmp 103 PID 3192 wrote to memory of 1776 3192 41CC.tmp 103 PID 3192 wrote to memory of 1776 3192 41CC.tmp 103 PID 1776 wrote to memory of 1424 1776 421A.tmp 104 PID 1776 wrote to memory of 1424 1776 421A.tmp 104 PID 1776 wrote to memory of 1424 1776 421A.tmp 104 PID 1424 wrote to memory of 408 1424 4287.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_2053e157d1d87ff6067828dca7fd6a99_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"23⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"24⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"25⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"26⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"27⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"28⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"29⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"30⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"31⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"32⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"33⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"34⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"35⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"36⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"37⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"38⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"39⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"40⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"41⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"42⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"43⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"44⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"45⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"46⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"47⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"48⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"49⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"50⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"51⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"52⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"53⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"54⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"55⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"56⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"57⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"58⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"59⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"60⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"61⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"62⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"63⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"64⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"65⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"66⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"67⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"68⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"69⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"70⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"71⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"72⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"73⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"74⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"75⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"76⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"77⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"78⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"79⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"80⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"81⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"82⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"83⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"84⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"85⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"86⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"87⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"88⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"89⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"90⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"91⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"92⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"93⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"94⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"95⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"96⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"97⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"98⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"99⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"100⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"101⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"102⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"103⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"104⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"105⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"106⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"107⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"108⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"109⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"110⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"111⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"112⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"113⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"114⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"115⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"116⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"117⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"118⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"119⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"120⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"121⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"122⤵PID:1868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-