Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
-
Size
536KB
-
MD5
c6ab5e7a8934e7b7204fd3d81fc7f033
-
SHA1
f8512408e6b6d6e3050c83b7d64df70c6bac183d
-
SHA256
fa0762cbe0d64a70df3b3a9d04374331705cba363b4350151bfd8b140f920b6f
-
SHA512
f90c5547a16895c06f7b8d53bd1af9323a40730bac430f5f21a149254b5660cb430cc9eb7fc2e4cd15a91070ca0c3dd0cec54f36897ce5ba025654fe04db710c
-
SSDEEP
12288:wU5rCOTeiU3sTlCOzlMHI9O2vLOsTmsVMIZxVJ0ZT9:wUQOJU3sThxdjBTmeMIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3480 23C4.tmp 4888 2422.tmp 3868 24DD.tmp 2676 2589.tmp 1064 2654.tmp 3104 26C2.tmp 2252 272F.tmp 3612 27CB.tmp 4772 2839.tmp 3464 28B6.tmp 1408 2942.tmp 1180 29B0.tmp 5044 2A3C.tmp 3332 2AC9.tmp 3392 2B75.tmp 2344 2BE2.tmp 1384 2C5F.tmp 2016 2CDC.tmp 4088 2D4A.tmp 3448 2DB7.tmp 3968 2E44.tmp 4008 2EB1.tmp 3132 2F5D.tmp 4044 2FDA.tmp 4860 3076.tmp 4172 30E3.tmp 1420 3170.tmp 4892 320C.tmp 1608 3326.tmp 1260 33A3.tmp 528 342F.tmp 2424 34AC.tmp 2428 350A.tmp 740 3558.tmp 5084 35A6.tmp 432 35F4.tmp 1060 3642.tmp 3104 3691.tmp 1300 36DF.tmp 5008 372D.tmp 5088 377B.tmp 4512 37C9.tmp 3436 3817.tmp 1592 3875.tmp 3912 38C3.tmp 3820 3911.tmp 3512 396F.tmp 1576 39BD.tmp 3392 3A0B.tmp 1004 3A59.tmp 1176 3AB7.tmp 2484 3B15.tmp 2376 3B73.tmp 1816 3BE0.tmp 4088 3C3E.tmp 640 3C9B.tmp 2924 3CEA.tmp 1484 3D38.tmp 1736 3D86.tmp 3888 3DD4.tmp 2220 3E22.tmp 2576 3E80.tmp 3708 3ECE.tmp 4172 3F1C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 3480 2160 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 85 PID 2160 wrote to memory of 3480 2160 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 85 PID 2160 wrote to memory of 3480 2160 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 85 PID 3480 wrote to memory of 4888 3480 23C4.tmp 86 PID 3480 wrote to memory of 4888 3480 23C4.tmp 86 PID 3480 wrote to memory of 4888 3480 23C4.tmp 86 PID 4888 wrote to memory of 3868 4888 2422.tmp 88 PID 4888 wrote to memory of 3868 4888 2422.tmp 88 PID 4888 wrote to memory of 3868 4888 2422.tmp 88 PID 3868 wrote to memory of 2676 3868 24DD.tmp 89 PID 3868 wrote to memory of 2676 3868 24DD.tmp 89 PID 3868 wrote to memory of 2676 3868 24DD.tmp 89 PID 2676 wrote to memory of 1064 2676 2589.tmp 91 PID 2676 wrote to memory of 1064 2676 2589.tmp 91 PID 2676 wrote to memory of 1064 2676 2589.tmp 91 PID 1064 wrote to memory of 3104 1064 2654.tmp 93 PID 1064 wrote to memory of 3104 1064 2654.tmp 93 PID 1064 wrote to memory of 3104 1064 2654.tmp 93 PID 3104 wrote to memory of 2252 3104 26C2.tmp 94 PID 3104 wrote to memory of 2252 3104 26C2.tmp 94 PID 3104 wrote to memory of 2252 3104 26C2.tmp 94 PID 2252 wrote to memory of 3612 2252 272F.tmp 95 PID 2252 wrote to memory of 3612 2252 272F.tmp 95 PID 2252 wrote to memory of 3612 2252 272F.tmp 95 PID 3612 wrote to memory of 4772 3612 27CB.tmp 96 PID 3612 wrote to memory of 4772 3612 27CB.tmp 96 PID 3612 wrote to memory of 4772 3612 27CB.tmp 96 PID 4772 wrote to memory of 3464 4772 2839.tmp 97 PID 4772 wrote to memory of 3464 4772 2839.tmp 97 PID 4772 wrote to memory of 3464 4772 2839.tmp 97 PID 3464 wrote to memory of 1408 3464 28B6.tmp 98 PID 3464 wrote to memory of 1408 3464 28B6.tmp 98 PID 3464 wrote to memory of 1408 3464 28B6.tmp 98 PID 1408 wrote to memory of 1180 1408 2942.tmp 99 PID 1408 wrote to memory of 1180 1408 2942.tmp 99 PID 1408 wrote to memory of 1180 1408 2942.tmp 99 PID 1180 wrote to memory of 5044 1180 29B0.tmp 100 PID 1180 wrote to memory of 5044 1180 29B0.tmp 100 PID 1180 wrote to memory of 5044 1180 29B0.tmp 100 PID 5044 wrote to memory of 3332 5044 2A3C.tmp 101 PID 5044 wrote to memory of 3332 5044 2A3C.tmp 101 PID 5044 wrote to memory of 3332 5044 2A3C.tmp 101 PID 3332 wrote to memory of 3392 3332 2AC9.tmp 102 PID 3332 wrote to memory of 3392 3332 2AC9.tmp 102 PID 3332 wrote to memory of 3392 3332 2AC9.tmp 102 PID 3392 wrote to memory of 2344 3392 2B75.tmp 103 PID 3392 wrote to memory of 2344 3392 2B75.tmp 103 PID 3392 wrote to memory of 2344 3392 2B75.tmp 103 PID 2344 wrote to memory of 1384 2344 2BE2.tmp 104 PID 2344 wrote to memory of 1384 2344 2BE2.tmp 104 PID 2344 wrote to memory of 1384 2344 2BE2.tmp 104 PID 1384 wrote to memory of 2016 1384 2C5F.tmp 105 PID 1384 wrote to memory of 2016 1384 2C5F.tmp 105 PID 1384 wrote to memory of 2016 1384 2C5F.tmp 105 PID 2016 wrote to memory of 4088 2016 2CDC.tmp 106 PID 2016 wrote to memory of 4088 2016 2CDC.tmp 106 PID 2016 wrote to memory of 4088 2016 2CDC.tmp 106 PID 4088 wrote to memory of 3448 4088 2D4A.tmp 107 PID 4088 wrote to memory of 3448 4088 2D4A.tmp 107 PID 4088 wrote to memory of 3448 4088 2D4A.tmp 107 PID 3448 wrote to memory of 3968 3448 2DB7.tmp 108 PID 3448 wrote to memory of 3968 3448 2DB7.tmp 108 PID 3448 wrote to memory of 3968 3448 2DB7.tmp 108 PID 3968 wrote to memory of 4008 3968 2E44.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\23C4.tmp"C:\Users\Admin\AppData\Local\Temp\23C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\2422.tmp"C:\Users\Admin\AppData\Local\Temp\2422.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\24DD.tmp"C:\Users\Admin\AppData\Local\Temp\24DD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\2589.tmp"C:\Users\Admin\AppData\Local\Temp\2589.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2654.tmp"C:\Users\Admin\AppData\Local\Temp\2654.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\272F.tmp"C:\Users\Admin\AppData\Local\Temp\272F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\27CB.tmp"C:\Users\Admin\AppData\Local\Temp\27CB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\29B0.tmp"C:\Users\Admin\AppData\Local\Temp\29B0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2AC9.tmp"C:\Users\Admin\AppData\Local\Temp\2AC9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2B75.tmp"C:\Users\Admin\AppData\Local\Temp\2B75.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2CDC.tmp"C:\Users\Admin\AppData\Local\Temp\2CDC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\2E44.tmp"C:\Users\Admin\AppData\Local\Temp\2E44.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"C:\Users\Admin\AppData\Local\Temp\2EB1.tmp"23⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"C:\Users\Admin\AppData\Local\Temp\2F5D.tmp"24⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"C:\Users\Admin\AppData\Local\Temp\2FDA.tmp"25⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"26⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"27⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"28⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"29⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\32C8.tmp"C:\Users\Admin\AppData\Local\Temp\32C8.tmp"30⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"31⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\33A3.tmp"C:\Users\Admin\AppData\Local\Temp\33A3.tmp"32⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"33⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"34⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"35⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"36⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"37⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"38⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"39⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"40⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"41⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"42⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"43⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"44⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"45⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"46⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"47⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"48⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"49⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"50⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"51⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"52⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"53⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"54⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"55⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"56⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"57⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"C:\Users\Admin\AppData\Local\Temp\3C9B.tmp"58⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"59⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"60⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"61⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"62⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"63⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"64⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"65⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"66⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"67⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"68⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"69⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"70⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"71⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"72⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"73⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"74⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"75⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"76⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"78⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"79⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"80⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"81⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"82⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"83⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"84⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"85⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"86⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"87⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"88⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"89⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"90⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"91⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"92⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"93⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"94⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"95⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"96⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"97⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"98⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"99⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"100⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"101⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"102⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"103⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"104⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"105⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"106⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"107⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"108⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"109⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"110⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"111⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"112⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"113⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"114⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"115⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"116⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"117⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"118⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"119⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"120⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"121⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"122⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-