Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe
- Size 520KB
- Sample240612-ss225azdpc
- SHA256 55cdb7467280de9f5328c936123c665fa600f813e45bbf8830a8adf4dfbcf5f0
- MD5 1374cd13d922768a79b2e7b7cffedf9e
- SHA1 e366fd721d33a1b13a00607c70676b64beb9e48d
- SHA512 25dbedf9f162ac3dc853f57baf6ea9f9117b5f1a3e9d8b5b4b2aa84b13a585778f66500d43bfbb350705f0dac3db67fc063a3ecf30bdd73349b9ea9a44187547
- SSDEEP 12288:gj8fuxR21t5i8fDgEAIL+TvhFs722ktXNZ:gj8fuK1GYEEAILKjz2YN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5060 37F8.tmp 4860 3875.tmp 508 38D3.tmp 4068 395F.tmp 4632 39BD.tmp 2908 3A2A.tmp 3920 3AB7.tmp 1492 3B15.tmp 4704 3B73.tmp 3604 3BD0.tmp 3996 3C4D.tmp 4732 3CCA.tmp 1756 3D18.tmp 4988 3D95.tmp 4884 3E12.tmp 1768 3E70.tmp 4452 3EBE.tmp 2816 3F2C.tmp 372 3FA9.tmp 4748 3FF7.tmp 3100 4055.tmp 2388 40A3.tmp 2260 4120.tmp 4532 416E.tmp 3828 41CC.tmp 2056 4239.tmp 2640 4297.tmp 916 42F4.tmp 1732 4352.tmp 1124 43B0.tmp 3844 442D.tmp 4376 449A.tmp 1644 4508.tmp 2212 4556.tmp 1004 45A4.tmp 4908 45F2.tmp 2088 4640.tmp 2176 469E.tmp 1156 46EC.tmp 2228 474A.tmp 2784 4788.tmp 1524 47E6.tmp 3712 4844.tmp 4912 4892.tmp 2704 48E0.tmp 1820 492E.tmp 2976 497C.tmp 2980 49CA.tmp 4160 4A28.tmp 1188 4A76.tmp 4192 4AC4.tmp 2632 4B13.tmp 3076 4B61.tmp 1752 4BBE.tmp 4336 4C1C.tmp 1828 4C7A.tmp 1632 4D16.tmp 4852 4D64.tmp 3048 4DC2.tmp 3016 4E20.tmp 4436 4E7E.tmp 2392 4ECC.tmp 4236 4F29.tmp 1132 4F87.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 5060 3956 2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe 81 PID 3956 wrote to memory of 5060 3956 2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe 81 PID 3956 wrote to memory of 5060 3956 2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe 81 PID 5060 wrote to memory of 4860 5060 37F8.tmp 82 PID 5060 wrote to memory of 4860 5060 37F8.tmp 82 PID 5060 wrote to memory of 4860 5060 37F8.tmp 82 PID 4860 wrote to memory of 508 4860 3875.tmp 84 PID 4860 wrote to memory of 508 4860 3875.tmp 84 PID 4860 wrote to memory of 508 4860 3875.tmp 84 PID 508 wrote to memory of 4068 508 38D3.tmp 86 PID 508 wrote to memory of 4068 508 38D3.tmp 86 PID 508 wrote to memory of 4068 508 38D3.tmp 86 PID 4068 wrote to memory of 4632 4068 395F.tmp 87 PID 4068 wrote to memory of 4632 4068 395F.tmp 87 PID 4068 wrote to memory of 4632 4068 395F.tmp 87 PID 4632 wrote to memory of 2908 4632 39BD.tmp 89 PID 4632 wrote to memory of 2908 4632 39BD.tmp 89 PID 4632 wrote to memory of 2908 4632 39BD.tmp 89 PID 2908 wrote to memory of 3920 2908 3A2A.tmp 90 PID 2908 wrote to memory of 3920 2908 3A2A.tmp 90 PID 2908 wrote to memory of 3920 2908 3A2A.tmp 90 PID 3920 wrote to memory of 1492 3920 3AB7.tmp 91 PID 3920 wrote to memory of 1492 3920 3AB7.tmp 91 PID 3920 wrote to memory of 1492 3920 3AB7.tmp 91 PID 1492 wrote to memory of 4704 1492 3B15.tmp 92 PID 1492 wrote to memory of 4704 1492 3B15.tmp 92 PID 1492 wrote to memory of 4704 1492 3B15.tmp 92 PID 4704 wrote to memory of 3604 4704 3B73.tmp 93 PID 4704 wrote to memory of 3604 4704 3B73.tmp 93 PID 4704 wrote to memory of 3604 4704 3B73.tmp 93 PID 3604 wrote to memory of 3996 3604 3BD0.tmp 94 PID 3604 wrote to memory of 3996 3604 3BD0.tmp 94 PID 3604 wrote to memory of 3996 3604 3BD0.tmp 94 PID 3996 wrote to memory of 4732 3996 3C4D.tmp 95 PID 3996 wrote to memory of 4732 3996 3C4D.tmp 95 PID 3996 wrote to memory of 4732 3996 3C4D.tmp 95 PID 4732 wrote to memory of 1756 4732 3CCA.tmp 96 PID 4732 wrote to memory of 1756 4732 3CCA.tmp 96 PID 4732 wrote to memory of 1756 4732 3CCA.tmp 96 PID 1756 wrote to memory of 4988 1756 3D18.tmp 97 PID 1756 wrote to memory of 4988 1756 3D18.tmp 97 PID 1756 wrote to memory of 4988 1756 3D18.tmp 97 PID 4988 wrote to memory of 4884 4988 3D95.tmp 98 PID 4988 wrote to memory of 4884 4988 3D95.tmp 98 PID 4988 wrote to memory of 4884 4988 3D95.tmp 98 PID 4884 wrote to memory of 1768 4884 3E12.tmp 99 PID 4884 wrote to memory of 1768 4884 3E12.tmp 99 PID 4884 wrote to memory of 1768 4884 3E12.tmp 99 PID 1768 wrote to memory of 4452 1768 3E70.tmp 100 PID 1768 wrote to memory of 4452 1768 3E70.tmp 100 PID 1768 wrote to memory of 4452 1768 3E70.tmp 100 PID 4452 wrote to memory of 2816 4452 3EBE.tmp 101 PID 4452 wrote to memory of 2816 4452 3EBE.tmp 101 PID 4452 wrote to memory of 2816 4452 3EBE.tmp 101 PID 2816 wrote to memory of 372 2816 3F2C.tmp 102 PID 2816 wrote to memory of 372 2816 3F2C.tmp 102 PID 2816 wrote to memory of 372 2816 3F2C.tmp 102 PID 372 wrote to memory of 4748 372 3FA9.tmp 103 PID 372 wrote to memory of 4748 372 3FA9.tmp 103 PID 372 wrote to memory of 4748 372 3FA9.tmp 103 PID 4748 wrote to memory of 3100 4748 3FF7.tmp 104 PID 4748 wrote to memory of 3100 4748 3FF7.tmp 104 PID 4748 wrote to memory of 3100 4748 3FF7.tmp 104 PID 3100 wrote to memory of 2388 3100 4055.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_1374cd13d922768a79b2e7b7cffedf9e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"23⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"24⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"25⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"26⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"27⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"28⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"29⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"30⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"31⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"32⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"33⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"34⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"35⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"36⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"37⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"38⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"39⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"40⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"41⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"42⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"43⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"44⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"45⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"46⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"47⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"48⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"49⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"50⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"51⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"52⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"53⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"54⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"55⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"56⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"57⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"58⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"59⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"60⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"61⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"62⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"63⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"64⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"65⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"66⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"67⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"68⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"69⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"70⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"71⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"72⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"73⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"74⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"75⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"77⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"78⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"79⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"81⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"82⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"83⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"84⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"85⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"86⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"87⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"88⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"89⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"90⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"91⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"92⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"93⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"94⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"95⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"96⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"97⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"98⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"99⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"100⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"101⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"102⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"103⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"104⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"105⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"106⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"107⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"108⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"109⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"110⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"112⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"113⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"114⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"115⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"116⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"117⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"118⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"119⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"120⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"121⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"122⤵PID:532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-