Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe
-
Size
765KB
-
MD5
7a2132b83aec3cbc448d8b0bef011f30
-
SHA1
9ade9fc92065168f3a3cd1522c860179570da8b9
-
SHA256
e77ce5292c72f367c5ebaf59bb5220892b5960494ed5a25116a88325ff95d672
-
SHA512
a4e932e2a64a57fd6449724d7af7ca31c6c93d3cd8fb4c2c03fb691b83e6cf16d36cd712613b5f8dc999055b2d03926c828f7ce0a3ae76f18cc18c85bb54bf37
-
SSDEEP
12288:ZU5rCOTeiDCk9Tmv8TOL9Pr+Q83ZF5rn5rLOa54U5w5A:ZUQOJDCkMlQQ83vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4616 3CF9.tmp 4060 3D76.tmp 2340 3DE4.tmp 1732 3E70.tmp 3636 3EFD.tmp 1412 3F99.tmp 5068 4016.tmp 4476 40A3.tmp 2280 413F.tmp 3952 41AC.tmp 3012 4229.tmp 1724 4287.tmp 3788 4314.tmp 4868 4381.tmp 4984 43FE.tmp 4184 446B.tmp 5008 44D9.tmp 3772 4537.tmp 836 45C3.tmp 3324 4640.tmp 4352 46BD.tmp 4316 473A.tmp 2668 47D6.tmp 2944 4844.tmp 2448 48A2.tmp 4036 48FF.tmp 4500 498C.tmp 4692 49F9.tmp 840 4A67.tmp 4436 4B03.tmp 4660 4B70.tmp 1612 4BFD.tmp 888 4C8A.tmp 1016 4CE7.tmp 4772 4D35.tmp 1732 4D93.tmp 3504 4DE1.tmp 3112 4E3F.tmp 1436 4E8D.tmp 3000 4EDB.tmp 2352 4F39.tmp 692 4F87.tmp 4932 4FE5.tmp 3012 5033.tmp 2680 5091.tmp 3996 50DF.tmp 2268 513D.tmp 1456 519A.tmp 4984 51F8.tmp 1716 5246.tmp 2648 52A4.tmp 2628 52F2.tmp 1936 5350.tmp 632 539E.tmp 2008 53EC.tmp 3388 543A.tmp 2804 5498.tmp 3768 54E6.tmp 2504 5544.tmp 4996 5592.tmp 772 55F0.tmp 216 564E.tmp 3720 56AB.tmp 3096 5709.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 4616 3976 2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe 87 PID 3976 wrote to memory of 4616 3976 2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe 87 PID 3976 wrote to memory of 4616 3976 2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe 87 PID 4616 wrote to memory of 4060 4616 3CF9.tmp 88 PID 4616 wrote to memory of 4060 4616 3CF9.tmp 88 PID 4616 wrote to memory of 4060 4616 3CF9.tmp 88 PID 4060 wrote to memory of 2340 4060 3D76.tmp 90 PID 4060 wrote to memory of 2340 4060 3D76.tmp 90 PID 4060 wrote to memory of 2340 4060 3D76.tmp 90 PID 2340 wrote to memory of 1732 2340 3DE4.tmp 91 PID 2340 wrote to memory of 1732 2340 3DE4.tmp 91 PID 2340 wrote to memory of 1732 2340 3DE4.tmp 91 PID 1732 wrote to memory of 3636 1732 3E70.tmp 93 PID 1732 wrote to memory of 3636 1732 3E70.tmp 93 PID 1732 wrote to memory of 3636 1732 3E70.tmp 93 PID 3636 wrote to memory of 1412 3636 3EFD.tmp 94 PID 3636 wrote to memory of 1412 3636 3EFD.tmp 94 PID 3636 wrote to memory of 1412 3636 3EFD.tmp 94 PID 1412 wrote to memory of 5068 1412 3F99.tmp 95 PID 1412 wrote to memory of 5068 1412 3F99.tmp 95 PID 1412 wrote to memory of 5068 1412 3F99.tmp 95 PID 5068 wrote to memory of 4476 5068 4016.tmp 96 PID 5068 wrote to memory of 4476 5068 4016.tmp 96 PID 5068 wrote to memory of 4476 5068 4016.tmp 96 PID 4476 wrote to memory of 2280 4476 40A3.tmp 97 PID 4476 wrote to memory of 2280 4476 40A3.tmp 97 PID 4476 wrote to memory of 2280 4476 40A3.tmp 97 PID 2280 wrote to memory of 3952 2280 413F.tmp 98 PID 2280 wrote to memory of 3952 2280 413F.tmp 98 PID 2280 wrote to memory of 3952 2280 413F.tmp 98 PID 3952 wrote to memory of 3012 3952 41AC.tmp 99 PID 3952 wrote to memory of 3012 3952 41AC.tmp 99 PID 3952 wrote to memory of 3012 3952 41AC.tmp 99 PID 3012 wrote to memory of 1724 3012 4229.tmp 100 PID 3012 wrote to memory of 1724 3012 4229.tmp 100 PID 3012 wrote to memory of 1724 3012 4229.tmp 100 PID 1724 wrote to memory of 3788 1724 4287.tmp 101 PID 1724 wrote to memory of 3788 1724 4287.tmp 101 PID 1724 wrote to memory of 3788 1724 4287.tmp 101 PID 3788 wrote to memory of 4868 3788 4314.tmp 102 PID 3788 wrote to memory of 4868 3788 4314.tmp 102 PID 3788 wrote to memory of 4868 3788 4314.tmp 102 PID 4868 wrote to memory of 4984 4868 4381.tmp 103 PID 4868 wrote to memory of 4984 4868 4381.tmp 103 PID 4868 wrote to memory of 4984 4868 4381.tmp 103 PID 4984 wrote to memory of 4184 4984 43FE.tmp 104 PID 4984 wrote to memory of 4184 4984 43FE.tmp 104 PID 4984 wrote to memory of 4184 4984 43FE.tmp 104 PID 4184 wrote to memory of 5008 4184 446B.tmp 105 PID 4184 wrote to memory of 5008 4184 446B.tmp 105 PID 4184 wrote to memory of 5008 4184 446B.tmp 105 PID 5008 wrote to memory of 3772 5008 44D9.tmp 106 PID 5008 wrote to memory of 3772 5008 44D9.tmp 106 PID 5008 wrote to memory of 3772 5008 44D9.tmp 106 PID 3772 wrote to memory of 836 3772 4537.tmp 107 PID 3772 wrote to memory of 836 3772 4537.tmp 107 PID 3772 wrote to memory of 836 3772 4537.tmp 107 PID 836 wrote to memory of 3324 836 45C3.tmp 110 PID 836 wrote to memory of 3324 836 45C3.tmp 110 PID 836 wrote to memory of 3324 836 45C3.tmp 110 PID 3324 wrote to memory of 4352 3324 4640.tmp 111 PID 3324 wrote to memory of 4352 3324 4640.tmp 111 PID 3324 wrote to memory of 4352 3324 4640.tmp 111 PID 4352 wrote to memory of 4316 4352 46BD.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_7a2132b83aec3cbc448d8b0bef011f30_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"23⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"24⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"25⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"26⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"27⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"28⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"29⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"30⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"31⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"32⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"33⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"34⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"35⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"36⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"37⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"38⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"39⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"40⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"41⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"42⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"43⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"44⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"45⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"46⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"47⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"48⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"49⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"50⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"51⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"52⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"53⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"54⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"55⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"56⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"57⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"58⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"59⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"60⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"61⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"62⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"63⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"64⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"65⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"66⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"67⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"68⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"69⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"70⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"71⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"72⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"73⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"74⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"75⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"76⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"77⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"78⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"79⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"80⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"81⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"82⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"84⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"85⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"86⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"88⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"89⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"90⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"91⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"92⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"93⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"94⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"95⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"96⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"97⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"98⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"99⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"100⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"101⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"102⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"103⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"104⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"105⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"106⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"107⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"109⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"110⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"111⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"112⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"113⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"114⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"115⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"116⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"117⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"118⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"119⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"120⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"121⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-