Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe
-
Size
527KB
-
MD5
ef0c27cfb675af8292f1644855e11dfc
-
SHA1
c7418d806b858950506575acd1fdad38c9268e85
-
SHA256
87db29acbd5b60224f3eb1f52ecfa78b927a5c402f848270bfc7c6744bd57df8
-
SHA512
d3663e9ec62d427ad17c9f0e7cf7b8e1ff5f6d4309a499f6c7f1faabc474e30d71d8bfb92f72e6a5c2d92eab66743748327b6617de1858898597e800ff15aae4
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYZBqfFx+95biwCtXk2VSiIyHInzJUTqqQJl64:fU5rCOTeidYsx+HR0Knz+q16SxuDZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4148 1066.tmp 2624 11FC.tmp 4404 12B8.tmp 3792 1373.tmp 2324 145E.tmp 4968 150A.tmp 2768 1604.tmp 116 17D8.tmp 1264 199E.tmp 4460 1A98.tmp 2380 1B24.tmp 1916 1BEF.tmp 4396 1CCA.tmp 2244 1DD4.tmp 3288 1E9F.tmp 1840 2323.tmp 5000 247B.tmp 2608 2565.tmp 1108 27D6.tmp 2604 28A1.tmp 3336 293E.tmp 4152 2A38.tmp 1656 2B03.tmp 4960 2BFD.tmp 4380 2CB8.tmp 4688 2E5E.tmp 3312 2F29.tmp 3796 2FB6.tmp 2784 3071.tmp 3444 313C.tmp 636 3311.tmp 3128 33EC.tmp 2336 3488.tmp 3144 3505.tmp 4836 35A1.tmp 3836 36AB.tmp 904 3767.tmp 4888 394B.tmp 1944 39E7.tmp 536 3AB2.tmp 2872 3B3F.tmp 2624 3BDB.tmp 4620 3D33.tmp 1284 3E5C.tmp 1216 3EE8.tmp 2324 3F75.tmp 1948 4021.tmp 3620 41A8.tmp 3856 42C1.tmp 2804 432E.tmp 3840 43AB.tmp 5024 4467.tmp 912 44E4.tmp 4760 4551.tmp 1544 45CE.tmp 4396 466A.tmp 5076 46F7.tmp 1664 4784.tmp 448 483F.tmp 3680 48DB.tmp 4648 4958.tmp 4748 4AFE.tmp 3156 4B8B.tmp 3940 4C17.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4148 3452 2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe 91 PID 3452 wrote to memory of 4148 3452 2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe 91 PID 3452 wrote to memory of 4148 3452 2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe 91 PID 4148 wrote to memory of 2624 4148 1066.tmp 92 PID 4148 wrote to memory of 2624 4148 1066.tmp 92 PID 4148 wrote to memory of 2624 4148 1066.tmp 92 PID 2624 wrote to memory of 4404 2624 11FC.tmp 93 PID 2624 wrote to memory of 4404 2624 11FC.tmp 93 PID 2624 wrote to memory of 4404 2624 11FC.tmp 93 PID 4404 wrote to memory of 3792 4404 12B8.tmp 94 PID 4404 wrote to memory of 3792 4404 12B8.tmp 94 PID 4404 wrote to memory of 3792 4404 12B8.tmp 94 PID 3792 wrote to memory of 2324 3792 1373.tmp 95 PID 3792 wrote to memory of 2324 3792 1373.tmp 95 PID 3792 wrote to memory of 2324 3792 1373.tmp 95 PID 2324 wrote to memory of 4968 2324 145E.tmp 96 PID 2324 wrote to memory of 4968 2324 145E.tmp 96 PID 2324 wrote to memory of 4968 2324 145E.tmp 96 PID 4968 wrote to memory of 2768 4968 150A.tmp 97 PID 4968 wrote to memory of 2768 4968 150A.tmp 97 PID 4968 wrote to memory of 2768 4968 150A.tmp 97 PID 2768 wrote to memory of 116 2768 1604.tmp 98 PID 2768 wrote to memory of 116 2768 1604.tmp 98 PID 2768 wrote to memory of 116 2768 1604.tmp 98 PID 116 wrote to memory of 1264 116 17D8.tmp 99 PID 116 wrote to memory of 1264 116 17D8.tmp 99 PID 116 wrote to memory of 1264 116 17D8.tmp 99 PID 1264 wrote to memory of 4460 1264 199E.tmp 100 PID 1264 wrote to memory of 4460 1264 199E.tmp 100 PID 1264 wrote to memory of 4460 1264 199E.tmp 100 PID 4460 wrote to memory of 2380 4460 1A98.tmp 101 PID 4460 wrote to memory of 2380 4460 1A98.tmp 101 PID 4460 wrote to memory of 2380 4460 1A98.tmp 101 PID 2380 wrote to memory of 1916 2380 1B24.tmp 102 PID 2380 wrote to memory of 1916 2380 1B24.tmp 102 PID 2380 wrote to memory of 1916 2380 1B24.tmp 102 PID 1916 wrote to memory of 4396 1916 1BEF.tmp 103 PID 1916 wrote to memory of 4396 1916 1BEF.tmp 103 PID 1916 wrote to memory of 4396 1916 1BEF.tmp 103 PID 4396 wrote to memory of 2244 4396 1CCA.tmp 104 PID 4396 wrote to memory of 2244 4396 1CCA.tmp 104 PID 4396 wrote to memory of 2244 4396 1CCA.tmp 104 PID 2244 wrote to memory of 3288 2244 1DD4.tmp 105 PID 2244 wrote to memory of 3288 2244 1DD4.tmp 105 PID 2244 wrote to memory of 3288 2244 1DD4.tmp 105 PID 3288 wrote to memory of 1840 3288 1E9F.tmp 106 PID 3288 wrote to memory of 1840 3288 1E9F.tmp 106 PID 3288 wrote to memory of 1840 3288 1E9F.tmp 106 PID 1840 wrote to memory of 5000 1840 2323.tmp 107 PID 1840 wrote to memory of 5000 1840 2323.tmp 107 PID 1840 wrote to memory of 5000 1840 2323.tmp 107 PID 5000 wrote to memory of 2608 5000 247B.tmp 108 PID 5000 wrote to memory of 2608 5000 247B.tmp 108 PID 5000 wrote to memory of 2608 5000 247B.tmp 108 PID 2608 wrote to memory of 1108 2608 2565.tmp 109 PID 2608 wrote to memory of 1108 2608 2565.tmp 109 PID 2608 wrote to memory of 1108 2608 2565.tmp 109 PID 1108 wrote to memory of 2604 1108 27D6.tmp 110 PID 1108 wrote to memory of 2604 1108 27D6.tmp 110 PID 1108 wrote to memory of 2604 1108 27D6.tmp 110 PID 2604 wrote to memory of 3336 2604 28A1.tmp 111 PID 2604 wrote to memory of 3336 2604 28A1.tmp 111 PID 2604 wrote to memory of 3336 2604 28A1.tmp 111 PID 3336 wrote to memory of 4152 3336 293E.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_ef0c27cfb675af8292f1644855e11dfc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"23⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"24⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"25⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"26⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"27⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"28⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"29⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"30⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"31⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"32⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"33⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"34⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"35⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"36⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"37⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"38⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"39⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"40⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"41⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"42⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"43⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"44⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"45⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"46⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"47⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"48⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"49⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"50⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"51⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"52⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"53⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"54⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"55⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"56⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"57⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"58⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"59⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"60⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"61⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"62⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"63⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"64⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"65⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"66⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"67⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"69⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"70⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"71⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"72⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"73⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"74⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"75⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"76⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"77⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"78⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"79⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"80⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"81⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"82⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"83⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"84⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"85⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"86⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"87⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"88⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"89⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"90⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"92⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"93⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"94⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"95⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"96⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"97⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"98⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"99⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"100⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"101⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"102⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"103⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"104⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"105⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"106⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"107⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"108⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"109⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"110⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"112⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"113⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"114⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"115⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"116⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"117⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"118⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"119⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"120⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"121⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-