Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
-
Size
488KB
-
MD5
efbc07997341353b9fb72ce02ecd9864
-
SHA1
d5d86bc14ea630e78adf3010088246159a599b25
-
SHA256
1b94bf805eae04909b4c324b035b1a836a90b1b93b123a4fb11ad604556b9bba
-
SHA512
0f636ecab8303cc478bbba8e7cdf9c94a94a6ceeac5945f41e0630452a2309ab2541b38a8d7844028c689de9a5cd774967c4190129452992a59989541bd8cf67
-
SSDEEP
12288:/U5rCOTeiD95VXL2U5fN2S9r2/iTSjFNZ:/UQOJD95V7D5f4N5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2480 4527.tmp 2032 45A4.tmp 5108 4621.tmp 5116 468E.tmp 4164 46EC.tmp 3756 473A.tmp 3204 47A8.tmp 3800 4805.tmp 2196 4882.tmp 464 48F0.tmp 2004 493E.tmp 4424 499C.tmp 1032 49EA.tmp 2392 4BBE.tmp 4712 4C1C.tmp 4172 4C6A.tmp 4040 4CC8.tmp 1412 4D35.tmp 3620 4DA3.tmp 556 4E10.tmp 4848 4E7E.tmp 4740 4EEB.tmp 4184 4F39.tmp 540 4F97.tmp 4420 5004.tmp 4952 5072.tmp 1632 50CF.tmp 4284 511D.tmp 1028 516C.tmp 3484 51BA.tmp 4120 5227.tmp 4512 5294.tmp 1320 5302.tmp 4840 5350.tmp 4384 53AE.tmp 3584 540B.tmp 2052 545A.tmp 3564 54B7.tmp 5104 5505.tmp 728 5563.tmp 1904 55C1.tmp 4452 560F.tmp 2912 565D.tmp 1688 56BB.tmp 2948 5719.tmp 2032 5776.tmp 5108 57C5.tmp 3232 5813.tmp 4532 5861.tmp 5116 58BF.tmp 3696 594B.tmp 4980 5999.tmp 396 59E7.tmp 4948 5A36.tmp 3404 5A93.tmp 3560 5AE1.tmp 212 5B30.tmp 2280 5B7E.tmp 216 5BCC.tmp 4056 5C2A.tmp 4152 5C78.tmp 464 5CC6.tmp 3496 5D14.tmp 5008 5D62.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2480 2912 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 84 PID 2912 wrote to memory of 2480 2912 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 84 PID 2912 wrote to memory of 2480 2912 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 84 PID 2480 wrote to memory of 2032 2480 4527.tmp 85 PID 2480 wrote to memory of 2032 2480 4527.tmp 85 PID 2480 wrote to memory of 2032 2480 4527.tmp 85 PID 2032 wrote to memory of 5108 2032 45A4.tmp 86 PID 2032 wrote to memory of 5108 2032 45A4.tmp 86 PID 2032 wrote to memory of 5108 2032 45A4.tmp 86 PID 5108 wrote to memory of 5116 5108 4621.tmp 87 PID 5108 wrote to memory of 5116 5108 4621.tmp 87 PID 5108 wrote to memory of 5116 5108 4621.tmp 87 PID 5116 wrote to memory of 4164 5116 468E.tmp 88 PID 5116 wrote to memory of 4164 5116 468E.tmp 88 PID 5116 wrote to memory of 4164 5116 468E.tmp 88 PID 4164 wrote to memory of 3756 4164 46EC.tmp 89 PID 4164 wrote to memory of 3756 4164 46EC.tmp 89 PID 4164 wrote to memory of 3756 4164 46EC.tmp 89 PID 3756 wrote to memory of 3204 3756 473A.tmp 90 PID 3756 wrote to memory of 3204 3756 473A.tmp 90 PID 3756 wrote to memory of 3204 3756 473A.tmp 90 PID 3204 wrote to memory of 3800 3204 47A8.tmp 91 PID 3204 wrote to memory of 3800 3204 47A8.tmp 91 PID 3204 wrote to memory of 3800 3204 47A8.tmp 91 PID 3800 wrote to memory of 2196 3800 4805.tmp 92 PID 3800 wrote to memory of 2196 3800 4805.tmp 92 PID 3800 wrote to memory of 2196 3800 4805.tmp 92 PID 2196 wrote to memory of 464 2196 4882.tmp 93 PID 2196 wrote to memory of 464 2196 4882.tmp 93 PID 2196 wrote to memory of 464 2196 4882.tmp 93 PID 464 wrote to memory of 2004 464 48F0.tmp 94 PID 464 wrote to memory of 2004 464 48F0.tmp 94 PID 464 wrote to memory of 2004 464 48F0.tmp 94 PID 2004 wrote to memory of 4424 2004 493E.tmp 95 PID 2004 wrote to memory of 4424 2004 493E.tmp 95 PID 2004 wrote to memory of 4424 2004 493E.tmp 95 PID 4424 wrote to memory of 1032 4424 499C.tmp 96 PID 4424 wrote to memory of 1032 4424 499C.tmp 96 PID 4424 wrote to memory of 1032 4424 499C.tmp 96 PID 1032 wrote to memory of 2392 1032 49EA.tmp 97 PID 1032 wrote to memory of 2392 1032 49EA.tmp 97 PID 1032 wrote to memory of 2392 1032 49EA.tmp 97 PID 2392 wrote to memory of 4712 2392 4BBE.tmp 98 PID 2392 wrote to memory of 4712 2392 4BBE.tmp 98 PID 2392 wrote to memory of 4712 2392 4BBE.tmp 98 PID 4712 wrote to memory of 4172 4712 4C1C.tmp 99 PID 4712 wrote to memory of 4172 4712 4C1C.tmp 99 PID 4712 wrote to memory of 4172 4712 4C1C.tmp 99 PID 4172 wrote to memory of 4040 4172 4C6A.tmp 100 PID 4172 wrote to memory of 4040 4172 4C6A.tmp 100 PID 4172 wrote to memory of 4040 4172 4C6A.tmp 100 PID 4040 wrote to memory of 1412 4040 4CC8.tmp 101 PID 4040 wrote to memory of 1412 4040 4CC8.tmp 101 PID 4040 wrote to memory of 1412 4040 4CC8.tmp 101 PID 1412 wrote to memory of 3620 1412 4D35.tmp 102 PID 1412 wrote to memory of 3620 1412 4D35.tmp 102 PID 1412 wrote to memory of 3620 1412 4D35.tmp 102 PID 3620 wrote to memory of 556 3620 4DA3.tmp 103 PID 3620 wrote to memory of 556 3620 4DA3.tmp 103 PID 3620 wrote to memory of 556 3620 4DA3.tmp 103 PID 556 wrote to memory of 4848 556 4E10.tmp 104 PID 556 wrote to memory of 4848 556 4E10.tmp 104 PID 556 wrote to memory of 4848 556 4E10.tmp 104 PID 4848 wrote to memory of 4740 4848 4E7E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"23⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"24⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"25⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"26⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"27⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"28⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"29⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"30⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"31⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"32⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"33⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"34⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"35⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"36⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"37⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"38⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"39⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"40⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"41⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"42⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"43⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"44⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"45⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"46⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"47⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"48⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"49⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"50⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"51⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"52⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"53⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"54⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"55⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"56⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"57⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"58⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"59⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"60⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"61⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"62⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"63⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"64⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"65⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"66⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"67⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"68⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"69⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"70⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"72⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"73⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"74⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"75⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"77⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"78⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"79⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"80⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"81⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"82⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"83⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"84⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"85⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"86⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"87⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"88⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"89⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"90⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"91⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"92⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"93⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"94⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"95⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"96⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"97⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"98⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"99⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"100⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"101⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"102⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"103⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"104⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"105⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"106⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"107⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"108⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"109⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"110⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"111⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"112⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"113⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"114⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"115⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"116⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"117⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"118⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"119⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"120⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"121⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"122⤵PID:3496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-