Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe
-
Size
486KB
-
MD5
ff6964ce6c5e3e2623238decb6c1c3ec
-
SHA1
59599908c3afa525bdbd50f4c90a02a215b3f08e
-
SHA256
b4039df73210230d0e0fe5a87be8be04538d6cab67880ff95d3543ebf8941c7b
-
SHA512
2f83bb6e3378744a1418b658cb1007d84c72e3500b62415cd5456f5a57adc90bf160651dee935c90a1b37caf0cded0ccede66dc24070a7cf3bab6d50b5619f2f
-
SSDEEP
12288:UU5rCOTeiD1nsr/BtF4gW2odY/erc0xmEXCqFcENZ:UUQOJD1srDOEMlrVxmO7TN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 216 4CB8.tmp 3936 4D16.tmp 4920 4D74.tmp 2884 4DF1.tmp 2860 4E5E.tmp 3396 4ECC.tmp 4624 4F29.tmp 4672 4F87.tmp 2160 4FD5.tmp 3312 5023.tmp 3040 5072.tmp 1524 50DF.tmp 4600 515C.tmp 4852 51AA.tmp 3764 5208.tmp 2380 5266.tmp 3704 52C3.tmp 4880 5311.tmp 2088 5360.tmp 4520 53BD.tmp 4872 542B.tmp 1148 5488.tmp 312 54D7.tmp 2812 5544.tmp 3960 5592.tmp 4924 55E0.tmp 2652 564E.tmp 4796 56BB.tmp 2888 5709.tmp 4948 5767.tmp 3628 57C5.tmp 4532 5813.tmp 4480 5861.tmp 592 58BF.tmp 5028 590D.tmp 1932 595B.tmp 4552 59A9.tmp 2692 59F7.tmp 2268 5A45.tmp 3444 5AF1.tmp 2580 5B3F.tmp 4692 5B9D.tmp 3936 5BFB.tmp 852 5C58.tmp 4920 5CA7.tmp 3464 5CF5.tmp 1240 5D52.tmp 2884 5DA1.tmp 1404 5DEF.tmp 60 5E3D.tmp 1532 5E8B.tmp 3200 5ED9.tmp 1768 5F37.tmp 4704 5F95.tmp 1972 5FE3.tmp 4980 6031.tmp 4448 607F.tmp 3724 60DD.tmp 368 612B.tmp 5116 6179.tmp 4476 61C7.tmp 232 6215.tmp 4836 6263.tmp 4520 62B1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 216 4584 2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe 87 PID 4584 wrote to memory of 216 4584 2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe 87 PID 4584 wrote to memory of 216 4584 2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe 87 PID 216 wrote to memory of 3936 216 4CB8.tmp 88 PID 216 wrote to memory of 3936 216 4CB8.tmp 88 PID 216 wrote to memory of 3936 216 4CB8.tmp 88 PID 3936 wrote to memory of 4920 3936 4D16.tmp 89 PID 3936 wrote to memory of 4920 3936 4D16.tmp 89 PID 3936 wrote to memory of 4920 3936 4D16.tmp 89 PID 4920 wrote to memory of 2884 4920 4D74.tmp 90 PID 4920 wrote to memory of 2884 4920 4D74.tmp 90 PID 4920 wrote to memory of 2884 4920 4D74.tmp 90 PID 2884 wrote to memory of 2860 2884 4DF1.tmp 91 PID 2884 wrote to memory of 2860 2884 4DF1.tmp 91 PID 2884 wrote to memory of 2860 2884 4DF1.tmp 91 PID 2860 wrote to memory of 3396 2860 4E5E.tmp 92 PID 2860 wrote to memory of 3396 2860 4E5E.tmp 92 PID 2860 wrote to memory of 3396 2860 4E5E.tmp 92 PID 3396 wrote to memory of 4624 3396 4ECC.tmp 93 PID 3396 wrote to memory of 4624 3396 4ECC.tmp 93 PID 3396 wrote to memory of 4624 3396 4ECC.tmp 93 PID 4624 wrote to memory of 4672 4624 4F29.tmp 94 PID 4624 wrote to memory of 4672 4624 4F29.tmp 94 PID 4624 wrote to memory of 4672 4624 4F29.tmp 94 PID 4672 wrote to memory of 2160 4672 4F87.tmp 95 PID 4672 wrote to memory of 2160 4672 4F87.tmp 95 PID 4672 wrote to memory of 2160 4672 4F87.tmp 95 PID 2160 wrote to memory of 3312 2160 4FD5.tmp 96 PID 2160 wrote to memory of 3312 2160 4FD5.tmp 96 PID 2160 wrote to memory of 3312 2160 4FD5.tmp 96 PID 3312 wrote to memory of 3040 3312 5023.tmp 97 PID 3312 wrote to memory of 3040 3312 5023.tmp 97 PID 3312 wrote to memory of 3040 3312 5023.tmp 97 PID 3040 wrote to memory of 1524 3040 5072.tmp 98 PID 3040 wrote to memory of 1524 3040 5072.tmp 98 PID 3040 wrote to memory of 1524 3040 5072.tmp 98 PID 1524 wrote to memory of 4600 1524 50DF.tmp 99 PID 1524 wrote to memory of 4600 1524 50DF.tmp 99 PID 1524 wrote to memory of 4600 1524 50DF.tmp 99 PID 4600 wrote to memory of 4852 4600 515C.tmp 100 PID 4600 wrote to memory of 4852 4600 515C.tmp 100 PID 4600 wrote to memory of 4852 4600 515C.tmp 100 PID 4852 wrote to memory of 3764 4852 51AA.tmp 101 PID 4852 wrote to memory of 3764 4852 51AA.tmp 101 PID 4852 wrote to memory of 3764 4852 51AA.tmp 101 PID 3764 wrote to memory of 2380 3764 5208.tmp 102 PID 3764 wrote to memory of 2380 3764 5208.tmp 102 PID 3764 wrote to memory of 2380 3764 5208.tmp 102 PID 2380 wrote to memory of 3704 2380 5266.tmp 103 PID 2380 wrote to memory of 3704 2380 5266.tmp 103 PID 2380 wrote to memory of 3704 2380 5266.tmp 103 PID 3704 wrote to memory of 4880 3704 52C3.tmp 104 PID 3704 wrote to memory of 4880 3704 52C3.tmp 104 PID 3704 wrote to memory of 4880 3704 52C3.tmp 104 PID 4880 wrote to memory of 2088 4880 5311.tmp 105 PID 4880 wrote to memory of 2088 4880 5311.tmp 105 PID 4880 wrote to memory of 2088 4880 5311.tmp 105 PID 2088 wrote to memory of 4520 2088 5360.tmp 106 PID 2088 wrote to memory of 4520 2088 5360.tmp 106 PID 2088 wrote to memory of 4520 2088 5360.tmp 106 PID 4520 wrote to memory of 4872 4520 53BD.tmp 107 PID 4520 wrote to memory of 4872 4520 53BD.tmp 107 PID 4520 wrote to memory of 4872 4520 53BD.tmp 107 PID 4872 wrote to memory of 1148 4872 542B.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_ff6964ce6c5e3e2623238decb6c1c3ec_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"23⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"24⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"25⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"26⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"27⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"28⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"29⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"30⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"31⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"32⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"33⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"34⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"35⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"36⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"37⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"38⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"39⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"40⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"41⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"42⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"43⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"44⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"45⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"46⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"47⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"48⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"49⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"50⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"51⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"52⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"53⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"54⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"55⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"56⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"57⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"58⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"59⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"60⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"61⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"62⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"63⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"64⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"65⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"66⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"67⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"68⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"69⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"70⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"71⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"72⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"73⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"74⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"75⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"76⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"77⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"78⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"79⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"80⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"81⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"82⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"83⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"84⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"85⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"86⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"87⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"88⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"89⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"90⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"91⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"92⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"93⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"94⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"95⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"96⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"97⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"98⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"99⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"100⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"101⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"102⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"103⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"104⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"105⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"106⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"107⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"110⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"111⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"112⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"113⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"114⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"115⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"116⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"117⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"118⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"119⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"120⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"121⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"122⤵PID:3080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-