Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
-
Size
529KB
-
MD5
40829a75403222f6fdce220d6f991add
-
SHA1
64cb029e164bed1ba05d598da18ebb29b8216cc2
-
SHA256
a628bdc58ae496a0fd824da43fb520993eea4f928b1d269d27c4d9a9d714724c
-
SHA512
292f7ac73499e2fc3dd64ba96169d08764ab8d46a7f1757a9cdcb81716c6b38b47f3e685b668f001470b2d82e3a4b83dabd7c7137777ac6560eadac5be0137a9
-
SSDEEP
12288:NU5rCOTeijRPgWKF/znaADlmHvuss2nDVN5n96WQTZwlH4Hp:NUQOJjRPgWKRznvlmPuv2DVz9tQTSlH2
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4804 40A3.tmp 1072 413F.tmp 3536 41BC.tmp 3372 42A6.tmp 2316 4343.tmp 4544 43CF.tmp 3332 444C.tmp 1184 44C9.tmp 4296 4527.tmp 3040 4594.tmp 4032 45F2.tmp 400 468E.tmp 4392 46EC.tmp 3584 474A.tmp 3620 47B7.tmp 2132 4815.tmp 4308 4873.tmp 1092 48D0.tmp 1032 493E.tmp 2140 49AB.tmp 4668 49F9.tmp 1276 4A47.tmp 868 4AA5.tmp 4936 4B03.tmp 4216 4B70.tmp 564 4BDE.tmp 3660 4C2C.tmp 920 4C7A.tmp 5072 4CC8.tmp 1420 4D26.tmp 4400 4D74.tmp 4464 4DD2.tmp 752 4E20.tmp 2556 4E6E.tmp 4376 4ECC.tmp 1968 4F1A.tmp 2520 4F68.tmp 3376 4FB6.tmp 4204 5004.tmp 3908 5062.tmp 1004 50B0.tmp 4596 510E.tmp 2316 515C.tmp 3240 51AA.tmp 4872 51F8.tmp 4608 5246.tmp 1712 5294.tmp 4296 52F2.tmp 400 5350.tmp 2008 539E.tmp 2108 53EC.tmp 2212 543A.tmp 1136 5488.tmp 3756 54D7.tmp 3616 5525.tmp 644 5573.tmp 3252 55C1.tmp 4952 560F.tmp 2824 565D.tmp 3020 56AB.tmp 1780 56F9.tmp 2696 5748.tmp 4316 5796.tmp 2012 57E4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 4804 3580 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 82 PID 3580 wrote to memory of 4804 3580 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 82 PID 3580 wrote to memory of 4804 3580 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 82 PID 4804 wrote to memory of 1072 4804 40A3.tmp 83 PID 4804 wrote to memory of 1072 4804 40A3.tmp 83 PID 4804 wrote to memory of 1072 4804 40A3.tmp 83 PID 1072 wrote to memory of 3536 1072 413F.tmp 84 PID 1072 wrote to memory of 3536 1072 413F.tmp 84 PID 1072 wrote to memory of 3536 1072 413F.tmp 84 PID 3536 wrote to memory of 3372 3536 41BC.tmp 86 PID 3536 wrote to memory of 3372 3536 41BC.tmp 86 PID 3536 wrote to memory of 3372 3536 41BC.tmp 86 PID 3372 wrote to memory of 2316 3372 42A6.tmp 87 PID 3372 wrote to memory of 2316 3372 42A6.tmp 87 PID 3372 wrote to memory of 2316 3372 42A6.tmp 87 PID 2316 wrote to memory of 4544 2316 4343.tmp 88 PID 2316 wrote to memory of 4544 2316 4343.tmp 88 PID 2316 wrote to memory of 4544 2316 4343.tmp 88 PID 4544 wrote to memory of 3332 4544 43CF.tmp 89 PID 4544 wrote to memory of 3332 4544 43CF.tmp 89 PID 4544 wrote to memory of 3332 4544 43CF.tmp 89 PID 3332 wrote to memory of 1184 3332 444C.tmp 91 PID 3332 wrote to memory of 1184 3332 444C.tmp 91 PID 3332 wrote to memory of 1184 3332 444C.tmp 91 PID 1184 wrote to memory of 4296 1184 44C9.tmp 138 PID 1184 wrote to memory of 4296 1184 44C9.tmp 138 PID 1184 wrote to memory of 4296 1184 44C9.tmp 138 PID 4296 wrote to memory of 3040 4296 4527.tmp 94 PID 4296 wrote to memory of 3040 4296 4527.tmp 94 PID 4296 wrote to memory of 3040 4296 4527.tmp 94 PID 3040 wrote to memory of 4032 3040 4594.tmp 95 PID 3040 wrote to memory of 4032 3040 4594.tmp 95 PID 3040 wrote to memory of 4032 3040 4594.tmp 95 PID 4032 wrote to memory of 400 4032 45F2.tmp 96 PID 4032 wrote to memory of 400 4032 45F2.tmp 96 PID 4032 wrote to memory of 400 4032 45F2.tmp 96 PID 400 wrote to memory of 4392 400 468E.tmp 97 PID 400 wrote to memory of 4392 400 468E.tmp 97 PID 400 wrote to memory of 4392 400 468E.tmp 97 PID 4392 wrote to memory of 3584 4392 46EC.tmp 98 PID 4392 wrote to memory of 3584 4392 46EC.tmp 98 PID 4392 wrote to memory of 3584 4392 46EC.tmp 98 PID 3584 wrote to memory of 3620 3584 474A.tmp 99 PID 3584 wrote to memory of 3620 3584 474A.tmp 99 PID 3584 wrote to memory of 3620 3584 474A.tmp 99 PID 3620 wrote to memory of 2132 3620 47B7.tmp 100 PID 3620 wrote to memory of 2132 3620 47B7.tmp 100 PID 3620 wrote to memory of 2132 3620 47B7.tmp 100 PID 2132 wrote to memory of 4308 2132 4815.tmp 101 PID 2132 wrote to memory of 4308 2132 4815.tmp 101 PID 2132 wrote to memory of 4308 2132 4815.tmp 101 PID 4308 wrote to memory of 1092 4308 4873.tmp 102 PID 4308 wrote to memory of 1092 4308 4873.tmp 102 PID 4308 wrote to memory of 1092 4308 4873.tmp 102 PID 1092 wrote to memory of 1032 1092 48D0.tmp 103 PID 1092 wrote to memory of 1032 1092 48D0.tmp 103 PID 1092 wrote to memory of 1032 1092 48D0.tmp 103 PID 1032 wrote to memory of 2140 1032 493E.tmp 104 PID 1032 wrote to memory of 2140 1032 493E.tmp 104 PID 1032 wrote to memory of 2140 1032 493E.tmp 104 PID 2140 wrote to memory of 4668 2140 49AB.tmp 105 PID 2140 wrote to memory of 4668 2140 49AB.tmp 105 PID 2140 wrote to memory of 4668 2140 49AB.tmp 105 PID 4668 wrote to memory of 1276 4668 49F9.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"23⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"24⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"25⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"26⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"27⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"28⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"29⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"30⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"31⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"32⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"33⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"34⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"35⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"36⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"37⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"38⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"39⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"40⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"41⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"42⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"43⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"44⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"45⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"46⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"47⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"48⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"49⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"50⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"51⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"52⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"53⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"54⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"55⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"56⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"57⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"58⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"59⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"60⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"61⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"62⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"63⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"64⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"65⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"66⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"67⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"68⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"69⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"70⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"71⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"72⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"73⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"74⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"75⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"76⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"77⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"78⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"79⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"80⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"81⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"82⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"83⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"84⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"85⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"86⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"87⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"88⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"89⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"90⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"92⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"93⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"94⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"95⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"96⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"97⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"98⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"99⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"100⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"101⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"102⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"103⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"104⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"105⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"106⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"107⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"108⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"109⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"110⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"111⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"112⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"114⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"115⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"116⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"117⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"118⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"119⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"120⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"121⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"122⤵PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-