Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe
-
Size
520KB
-
MD5
f13f044a868cae7be0c738c1bbd0b5c8
-
SHA1
8fcfba5da4df52b97b14c71127cd58285f6b75b6
-
SHA256
2fd4fa6042451ad96e60b6985acb2bb46fb47511853fcbb6771f17fdefe61b6b
-
SHA512
5703ea620063dc73d8555cc63fdcfa4c2dcdb816b4a878ddae07460bb6c21d799524624726be8b51123e45a455c4a563c2962446e6842278bccd727c0b3a2fd7
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL5G+Ob93lhT7DTMBgk6SsWMVv5saHQTte3obpH:roRXOQjmOyp9OZ3j7Douk8nKteYblNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 560 41BC.tmp 4612 4239.tmp 552 42A6.tmp 2384 4314.tmp 4188 4371.tmp 2408 43FE.tmp 652 445C.tmp 3432 44BA.tmp 1200 4508.tmp 2060 4556.tmp 3332 45C3.tmp 4112 4640.tmp 4920 469E.tmp 3736 46EC.tmp 1708 4759.tmp 1808 47D6.tmp 4044 4834.tmp 4884 4892.tmp 4372 48F0.tmp 4260 497C.tmp 3028 49CA.tmp 1948 4A38.tmp 1652 4AB5.tmp 3592 4B22.tmp 4708 4B70.tmp 4552 4BED.tmp 4572 4C4B.tmp 2036 4CB8.tmp 4904 4D26.tmp 2848 4D93.tmp 2852 4E10.tmp 4856 4E5E.tmp 2460 4EEB.tmp 3112 4F39.tmp 2368 4F87.tmp 1784 4FE5.tmp 4076 5033.tmp 5004 5081.tmp 2072 50CF.tmp 1220 511D.tmp 3876 516C.tmp 4084 51C9.tmp 4720 5217.tmp 4512 5266.tmp 1504 52C3.tmp 3288 5321.tmp 1600 537F.tmp 2068 53CD.tmp 4912 542B.tmp 216 5479.tmp 4368 54C7.tmp 3296 5525.tmp 1248 5573.tmp 2260 55C1.tmp 1484 561F.tmp 4412 565D.tmp 516 56AB.tmp 4436 56F9.tmp 3732 5757.tmp 1624 57A5.tmp 4604 57F3.tmp 5088 5851.tmp 1216 589F.tmp 3064 58ED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 560 3780 2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe 83 PID 3780 wrote to memory of 560 3780 2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe 83 PID 3780 wrote to memory of 560 3780 2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe 83 PID 560 wrote to memory of 4612 560 41BC.tmp 85 PID 560 wrote to memory of 4612 560 41BC.tmp 85 PID 560 wrote to memory of 4612 560 41BC.tmp 85 PID 4612 wrote to memory of 552 4612 4239.tmp 87 PID 4612 wrote to memory of 552 4612 4239.tmp 87 PID 4612 wrote to memory of 552 4612 4239.tmp 87 PID 552 wrote to memory of 2384 552 42A6.tmp 88 PID 552 wrote to memory of 2384 552 42A6.tmp 88 PID 552 wrote to memory of 2384 552 42A6.tmp 88 PID 2384 wrote to memory of 4188 2384 4314.tmp 89 PID 2384 wrote to memory of 4188 2384 4314.tmp 89 PID 2384 wrote to memory of 4188 2384 4314.tmp 89 PID 4188 wrote to memory of 2408 4188 4371.tmp 90 PID 4188 wrote to memory of 2408 4188 4371.tmp 90 PID 4188 wrote to memory of 2408 4188 4371.tmp 90 PID 2408 wrote to memory of 652 2408 43FE.tmp 91 PID 2408 wrote to memory of 652 2408 43FE.tmp 91 PID 2408 wrote to memory of 652 2408 43FE.tmp 91 PID 652 wrote to memory of 3432 652 445C.tmp 92 PID 652 wrote to memory of 3432 652 445C.tmp 92 PID 652 wrote to memory of 3432 652 445C.tmp 92 PID 3432 wrote to memory of 1200 3432 44BA.tmp 93 PID 3432 wrote to memory of 1200 3432 44BA.tmp 93 PID 3432 wrote to memory of 1200 3432 44BA.tmp 93 PID 1200 wrote to memory of 2060 1200 4508.tmp 94 PID 1200 wrote to memory of 2060 1200 4508.tmp 94 PID 1200 wrote to memory of 2060 1200 4508.tmp 94 PID 2060 wrote to memory of 3332 2060 4556.tmp 95 PID 2060 wrote to memory of 3332 2060 4556.tmp 95 PID 2060 wrote to memory of 3332 2060 4556.tmp 95 PID 3332 wrote to memory of 4112 3332 45C3.tmp 96 PID 3332 wrote to memory of 4112 3332 45C3.tmp 96 PID 3332 wrote to memory of 4112 3332 45C3.tmp 96 PID 4112 wrote to memory of 4920 4112 4640.tmp 97 PID 4112 wrote to memory of 4920 4112 4640.tmp 97 PID 4112 wrote to memory of 4920 4112 4640.tmp 97 PID 4920 wrote to memory of 3736 4920 469E.tmp 98 PID 4920 wrote to memory of 3736 4920 469E.tmp 98 PID 4920 wrote to memory of 3736 4920 469E.tmp 98 PID 3736 wrote to memory of 1708 3736 46EC.tmp 99 PID 3736 wrote to memory of 1708 3736 46EC.tmp 99 PID 3736 wrote to memory of 1708 3736 46EC.tmp 99 PID 1708 wrote to memory of 1808 1708 4759.tmp 100 PID 1708 wrote to memory of 1808 1708 4759.tmp 100 PID 1708 wrote to memory of 1808 1708 4759.tmp 100 PID 1808 wrote to memory of 4044 1808 47D6.tmp 101 PID 1808 wrote to memory of 4044 1808 47D6.tmp 101 PID 1808 wrote to memory of 4044 1808 47D6.tmp 101 PID 4044 wrote to memory of 4884 4044 4834.tmp 102 PID 4044 wrote to memory of 4884 4044 4834.tmp 102 PID 4044 wrote to memory of 4884 4044 4834.tmp 102 PID 4884 wrote to memory of 4372 4884 4892.tmp 103 PID 4884 wrote to memory of 4372 4884 4892.tmp 103 PID 4884 wrote to memory of 4372 4884 4892.tmp 103 PID 4372 wrote to memory of 4260 4372 48F0.tmp 104 PID 4372 wrote to memory of 4260 4372 48F0.tmp 104 PID 4372 wrote to memory of 4260 4372 48F0.tmp 104 PID 4260 wrote to memory of 3028 4260 497C.tmp 105 PID 4260 wrote to memory of 3028 4260 497C.tmp 105 PID 4260 wrote to memory of 3028 4260 497C.tmp 105 PID 3028 wrote to memory of 1948 3028 49CA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_f13f044a868cae7be0c738c1bbd0b5c8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"23⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"24⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"25⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"26⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"27⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"28⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"29⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"30⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"31⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"32⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"33⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"34⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"35⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"36⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"37⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"38⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"39⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"40⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"41⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"42⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"43⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"44⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"45⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"46⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"47⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"48⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"49⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"50⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"51⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"52⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"53⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"54⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"55⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"56⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"57⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"58⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"59⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"60⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"61⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"62⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"63⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"64⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"66⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"67⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"68⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"70⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"71⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"72⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"73⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"74⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"75⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"76⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"77⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"78⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"79⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"80⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"81⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"82⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"83⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"84⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"85⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"86⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"87⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"88⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"89⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"90⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"91⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"92⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"93⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"94⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"95⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"96⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"97⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"98⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"99⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"100⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"101⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"102⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"103⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"104⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"105⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"106⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"107⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"108⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"109⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"110⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"111⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"112⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"113⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"114⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"115⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"116⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"117⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"119⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"120⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"121⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"122⤵PID:4056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-