Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 13:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe
-
Size
527KB
-
MD5
a27960c0d3e443e14fa1c1dabdf84784
-
SHA1
9e9051e2cbf9a0afc57aec4792244467f87c3dec
-
SHA256
469993389ef9a00331d97dd0d5dd0f0be70698434575d7d305c2361fe1b83776
-
SHA512
41bf391194978e159564a3e84bbbe793c8fa0bf63e59d05421f18da8d3ce833d1131cd56d431e6ce2718f15b3d46f19247fa86172c323cc7bb8ed2bd0bd71abf
-
SSDEEP
12288:fU5rCOTeidR8m63r29h8HztWBWGf54CDZu:fUQOJdRCr29h+zCxnDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4148 37D4.tmp 3912 3861.tmp 1188 38ED.tmp 4384 397A.tmp 1804 39E7.tmp 3504 3A55.tmp 2544 3AB2.tmp 4236 3B20.tmp 2860 3B7D.tmp 1424 3BEB.tmp 4000 3C77.tmp 4508 3D04.tmp 3284 3D62.tmp 396 3DEE.tmp 1648 3E6B.tmp 2872 3EBA.tmp 812 3F37.tmp 1584 3FC3.tmp 5056 4040.tmp 1240 40BD.tmp 5044 411B.tmp 632 4188.tmp 4532 41F6.tmp 1036 4253.tmp 4944 42B1.tmp 4464 430F.tmp 1540 439C.tmp 2056 4419.tmp 3336 4476.tmp 3164 44D4.tmp 2756 4551.tmp 2840 45BE.tmp 4596 461C.tmp 752 467A.tmp 5116 46C8.tmp 3404 4726.tmp 648 4774.tmp 1624 47C2.tmp 4764 4810.tmp 3912 486E.tmp 5020 48BC.tmp 3060 490A.tmp 4748 4968.tmp 2484 49B6.tmp 464 4A04.tmp 3956 4A52.tmp 4360 4AB0.tmp 2348 4AFE.tmp 2040 4B4C.tmp 2944 4BAA.tmp 1364 4BF8.tmp 2236 4C46.tmp 4240 4C94.tmp 2700 4CF2.tmp 2084 4D50.tmp 3112 4D9E.tmp 3820 4DEC.tmp 4400 4E4A.tmp 3460 4EA8.tmp 2464 4F05.tmp 4704 4F54.tmp 5056 4FA2.tmp 3440 4FFF.tmp 232 504E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4148 4156 2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe 90 PID 4156 wrote to memory of 4148 4156 2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe 90 PID 4156 wrote to memory of 4148 4156 2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe 90 PID 4148 wrote to memory of 3912 4148 37D4.tmp 92 PID 4148 wrote to memory of 3912 4148 37D4.tmp 92 PID 4148 wrote to memory of 3912 4148 37D4.tmp 92 PID 3912 wrote to memory of 1188 3912 3861.tmp 93 PID 3912 wrote to memory of 1188 3912 3861.tmp 93 PID 3912 wrote to memory of 1188 3912 3861.tmp 93 PID 1188 wrote to memory of 4384 1188 38ED.tmp 95 PID 1188 wrote to memory of 4384 1188 38ED.tmp 95 PID 1188 wrote to memory of 4384 1188 38ED.tmp 95 PID 4384 wrote to memory of 1804 4384 397A.tmp 96 PID 4384 wrote to memory of 1804 4384 397A.tmp 96 PID 4384 wrote to memory of 1804 4384 397A.tmp 96 PID 1804 wrote to memory of 3504 1804 39E7.tmp 97 PID 1804 wrote to memory of 3504 1804 39E7.tmp 97 PID 1804 wrote to memory of 3504 1804 39E7.tmp 97 PID 3504 wrote to memory of 2544 3504 3A55.tmp 98 PID 3504 wrote to memory of 2544 3504 3A55.tmp 98 PID 3504 wrote to memory of 2544 3504 3A55.tmp 98 PID 2544 wrote to memory of 4236 2544 3AB2.tmp 99 PID 2544 wrote to memory of 4236 2544 3AB2.tmp 99 PID 2544 wrote to memory of 4236 2544 3AB2.tmp 99 PID 4236 wrote to memory of 2860 4236 3B20.tmp 100 PID 4236 wrote to memory of 2860 4236 3B20.tmp 100 PID 4236 wrote to memory of 2860 4236 3B20.tmp 100 PID 2860 wrote to memory of 1424 2860 3B7D.tmp 101 PID 2860 wrote to memory of 1424 2860 3B7D.tmp 101 PID 2860 wrote to memory of 1424 2860 3B7D.tmp 101 PID 1424 wrote to memory of 4000 1424 3BEB.tmp 102 PID 1424 wrote to memory of 4000 1424 3BEB.tmp 102 PID 1424 wrote to memory of 4000 1424 3BEB.tmp 102 PID 4000 wrote to memory of 4508 4000 3C77.tmp 103 PID 4000 wrote to memory of 4508 4000 3C77.tmp 103 PID 4000 wrote to memory of 4508 4000 3C77.tmp 103 PID 4508 wrote to memory of 3284 4508 3D04.tmp 104 PID 4508 wrote to memory of 3284 4508 3D04.tmp 104 PID 4508 wrote to memory of 3284 4508 3D04.tmp 104 PID 3284 wrote to memory of 396 3284 3D62.tmp 105 PID 3284 wrote to memory of 396 3284 3D62.tmp 105 PID 3284 wrote to memory of 396 3284 3D62.tmp 105 PID 396 wrote to memory of 1648 396 3DEE.tmp 106 PID 396 wrote to memory of 1648 396 3DEE.tmp 106 PID 396 wrote to memory of 1648 396 3DEE.tmp 106 PID 1648 wrote to memory of 2872 1648 3E6B.tmp 107 PID 1648 wrote to memory of 2872 1648 3E6B.tmp 107 PID 1648 wrote to memory of 2872 1648 3E6B.tmp 107 PID 2872 wrote to memory of 812 2872 3EBA.tmp 108 PID 2872 wrote to memory of 812 2872 3EBA.tmp 108 PID 2872 wrote to memory of 812 2872 3EBA.tmp 108 PID 812 wrote to memory of 1584 812 3F37.tmp 109 PID 812 wrote to memory of 1584 812 3F37.tmp 109 PID 812 wrote to memory of 1584 812 3F37.tmp 109 PID 1584 wrote to memory of 5056 1584 3FC3.tmp 110 PID 1584 wrote to memory of 5056 1584 3FC3.tmp 110 PID 1584 wrote to memory of 5056 1584 3FC3.tmp 110 PID 5056 wrote to memory of 1240 5056 4040.tmp 111 PID 5056 wrote to memory of 1240 5056 4040.tmp 111 PID 5056 wrote to memory of 1240 5056 4040.tmp 111 PID 1240 wrote to memory of 5044 1240 40BD.tmp 112 PID 1240 wrote to memory of 5044 1240 40BD.tmp 112 PID 1240 wrote to memory of 5044 1240 40BD.tmp 112 PID 5044 wrote to memory of 632 5044 411B.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_a27960c0d3e443e14fa1c1dabdf84784_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"23⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"25⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"26⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\430F.tmp"C:\Users\Admin\AppData\Local\Temp\430F.tmp"27⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"28⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"29⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"30⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"31⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"32⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"33⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"34⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"35⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"36⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"37⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\4774.tmp"C:\Users\Admin\AppData\Local\Temp\4774.tmp"38⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"39⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"40⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"41⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"42⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"43⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"44⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"45⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"46⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"47⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"48⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"49⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"50⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"51⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"52⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"53⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"54⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"55⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"56⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"57⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"58⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"59⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"60⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"61⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"62⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"63⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"64⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"65⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"66⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"67⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"68⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"69⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"70⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"71⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"72⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"73⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"74⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"75⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"76⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"77⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"78⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"79⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"80⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"81⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"82⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"83⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"84⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"85⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"86⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"87⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"88⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"89⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"90⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"91⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"92⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"93⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"94⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"95⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"96⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"97⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"98⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"99⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"100⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"101⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"102⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"103⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"104⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"105⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"106⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"107⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"108⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"109⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"110⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"111⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"112⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"113⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"114⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"115⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"116⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"117⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"118⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"119⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"120⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"121⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"122⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-