Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
-
Size
520KB
-
MD5
822f156bee883eed5d6174164fe6ac23
-
SHA1
c8f7165effd60484d073762aa0bbd828f5b3dac0
-
SHA256
dd5bb73bed017478c811ba885f1068bd736c0d52b99564b5940e2ac90a1c1027
-
SHA512
7af3267c6869d59f99471059c7d3fed3767d9bff5679eb121b5542eb6c3cc4cf94c22a9b5599d67dba093776ac71cc290e55ab872dcab0f0b2a2ea8a51755902
-
SSDEEP
12288:roRXOQjmOyoKgJme4BBOQ7GkH/ne1fiNZ:rogQ9ylHre16N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3172 3E12.tmp 2064 3E8F.tmp 4616 3EDE.tmp 5064 3F4B.tmp 1176 3FB8.tmp 736 4026.tmp 3856 40B2.tmp 2716 4120.tmp 3960 417D.tmp 3932 41EB.tmp 2824 4239.tmp 4728 42A6.tmp 1208 4304.tmp 3008 4352.tmp 2928 43B0.tmp 1056 441D.tmp 4464 447B.tmp 4620 44D9.tmp 2324 4537.tmp 3208 4585.tmp 3288 45D3.tmp 2188 4621.tmp 4492 466F.tmp 1624 46CD.tmp 4732 473A.tmp 1444 4788.tmp 4232 4805.tmp 2384 4853.tmp 960 48A2.tmp 3152 48F0.tmp 3636 494D.tmp 2964 49CA.tmp 3488 4A47.tmp 2088 4A96.tmp 5004 4AE4.tmp 1140 4B32.tmp 1452 4B90.tmp 4900 4BDE.tmp 2244 4C3B.tmp 3812 4C8A.tmp 3296 4CD8.tmp 4760 4D35.tmp 2320 4D93.tmp 2740 4DF1.tmp 2400 4E4F.tmp 1484 4EAC.tmp 2648 4F0A.tmp 3464 4F68.tmp 4996 4FB6.tmp 1164 5014.tmp 4180 5072.tmp 1136 50C0.tmp 2948 511D.tmp 1440 516C.tmp 1708 51C9.tmp 1988 5227.tmp 4484 5275.tmp 3712 52D3.tmp 2644 5321.tmp 1664 536F.tmp 3704 53CD.tmp 4016 541B.tmp 5068 5469.tmp 3484 54C7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3340 wrote to memory of 3172 3340 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 82 PID 3340 wrote to memory of 3172 3340 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 82 PID 3340 wrote to memory of 3172 3340 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 82 PID 3172 wrote to memory of 2064 3172 3E12.tmp 83 PID 3172 wrote to memory of 2064 3172 3E12.tmp 83 PID 3172 wrote to memory of 2064 3172 3E12.tmp 83 PID 2064 wrote to memory of 4616 2064 3E8F.tmp 84 PID 2064 wrote to memory of 4616 2064 3E8F.tmp 84 PID 2064 wrote to memory of 4616 2064 3E8F.tmp 84 PID 4616 wrote to memory of 5064 4616 3EDE.tmp 85 PID 4616 wrote to memory of 5064 4616 3EDE.tmp 85 PID 4616 wrote to memory of 5064 4616 3EDE.tmp 85 PID 5064 wrote to memory of 1176 5064 3F4B.tmp 87 PID 5064 wrote to memory of 1176 5064 3F4B.tmp 87 PID 5064 wrote to memory of 1176 5064 3F4B.tmp 87 PID 1176 wrote to memory of 736 1176 3FB8.tmp 89 PID 1176 wrote to memory of 736 1176 3FB8.tmp 89 PID 1176 wrote to memory of 736 1176 3FB8.tmp 89 PID 736 wrote to memory of 3856 736 4026.tmp 91 PID 736 wrote to memory of 3856 736 4026.tmp 91 PID 736 wrote to memory of 3856 736 4026.tmp 91 PID 3856 wrote to memory of 2716 3856 40B2.tmp 92 PID 3856 wrote to memory of 2716 3856 40B2.tmp 92 PID 3856 wrote to memory of 2716 3856 40B2.tmp 92 PID 2716 wrote to memory of 3960 2716 4120.tmp 93 PID 2716 wrote to memory of 3960 2716 4120.tmp 93 PID 2716 wrote to memory of 3960 2716 4120.tmp 93 PID 3960 wrote to memory of 3932 3960 417D.tmp 94 PID 3960 wrote to memory of 3932 3960 417D.tmp 94 PID 3960 wrote to memory of 3932 3960 417D.tmp 94 PID 3932 wrote to memory of 2824 3932 41EB.tmp 95 PID 3932 wrote to memory of 2824 3932 41EB.tmp 95 PID 3932 wrote to memory of 2824 3932 41EB.tmp 95 PID 2824 wrote to memory of 4728 2824 4239.tmp 96 PID 2824 wrote to memory of 4728 2824 4239.tmp 96 PID 2824 wrote to memory of 4728 2824 4239.tmp 96 PID 4728 wrote to memory of 1208 4728 42A6.tmp 97 PID 4728 wrote to memory of 1208 4728 42A6.tmp 97 PID 4728 wrote to memory of 1208 4728 42A6.tmp 97 PID 1208 wrote to memory of 3008 1208 4304.tmp 98 PID 1208 wrote to memory of 3008 1208 4304.tmp 98 PID 1208 wrote to memory of 3008 1208 4304.tmp 98 PID 3008 wrote to memory of 2928 3008 4352.tmp 99 PID 3008 wrote to memory of 2928 3008 4352.tmp 99 PID 3008 wrote to memory of 2928 3008 4352.tmp 99 PID 2928 wrote to memory of 1056 2928 43B0.tmp 100 PID 2928 wrote to memory of 1056 2928 43B0.tmp 100 PID 2928 wrote to memory of 1056 2928 43B0.tmp 100 PID 1056 wrote to memory of 4464 1056 441D.tmp 101 PID 1056 wrote to memory of 4464 1056 441D.tmp 101 PID 1056 wrote to memory of 4464 1056 441D.tmp 101 PID 4464 wrote to memory of 4620 4464 447B.tmp 102 PID 4464 wrote to memory of 4620 4464 447B.tmp 102 PID 4464 wrote to memory of 4620 4464 447B.tmp 102 PID 4620 wrote to memory of 2324 4620 44D9.tmp 103 PID 4620 wrote to memory of 2324 4620 44D9.tmp 103 PID 4620 wrote to memory of 2324 4620 44D9.tmp 103 PID 2324 wrote to memory of 3208 2324 4537.tmp 104 PID 2324 wrote to memory of 3208 2324 4537.tmp 104 PID 2324 wrote to memory of 3208 2324 4537.tmp 104 PID 3208 wrote to memory of 3288 3208 4585.tmp 105 PID 3208 wrote to memory of 3288 3208 4585.tmp 105 PID 3208 wrote to memory of 3288 3208 4585.tmp 105 PID 3288 wrote to memory of 2188 3288 45D3.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"23⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"24⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"25⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"26⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"27⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"28⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"29⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"30⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"31⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"32⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"33⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"34⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"35⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"36⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"37⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"38⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"39⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"40⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"41⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"42⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"43⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"44⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"45⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"46⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"47⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"48⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"49⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"50⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"51⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"52⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"53⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"54⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"55⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"56⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"57⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"58⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"59⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"60⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"61⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"62⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"63⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"64⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"65⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"66⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"67⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"68⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"69⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"70⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"71⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"72⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"73⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"74⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"75⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"76⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"77⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"78⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"79⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"80⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"81⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"82⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"83⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"84⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"85⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"86⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"87⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"88⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"89⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"90⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"91⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"92⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"93⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"94⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"95⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"96⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"97⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"98⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"99⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"100⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"101⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"103⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"104⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"105⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"106⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"107⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"109⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"110⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"111⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"112⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"113⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"114⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"115⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"116⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"117⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"118⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"119⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"120⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"122⤵PID:60
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-