Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe
-
Size
530KB
-
MD5
dd46b7dd659405f1a491a624e99bd2f9
-
SHA1
8de47079c29cf098ddcbbd8299c890df4721e954
-
SHA256
88bd4c8fca3c53045c0408703a9e4e0a4eaaa9cf4e55e4a08f7d3c2d9aeabc37
-
SHA512
81c577b5d9a5113d44bf81b4bd7275b74aff40946d456f79cc484261797282d554ab00a8c4ee39b2039a5f4c1a5772299e0d0a33c4df146ad4c5d0cd47eed9d6
-
SSDEEP
12288:AU5rCOTeiovUr/uSRrvxUIXIUbCJywNZulFVg0M1:AUQOJovUr/JmUmJHNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4276 54B7.tmp 1288 5525.tmp 4460 55A2.tmp 440 560F.tmp 376 568C.tmp 4248 5709.tmp 3772 5776.tmp 1236 5803.tmp 1576 5870.tmp 4932 58CE.tmp 2892 592C.tmp 664 598A.tmp 1148 59F7.tmp 3880 5A45.tmp 3308 5AC2.tmp 3204 5B3F.tmp 3740 5B8D.tmp 1764 5C2A.tmp 4104 5C97.tmp 3788 5D24.tmp 3108 5DA1.tmp 1948 5DFE.tmp 2392 5E4C.tmp 1168 5E9B.tmp 2524 5EE9.tmp 2224 5F75.tmp 1608 5FE3.tmp 884 6040.tmp 1100 609E.tmp 4836 610C.tmp 448 6169.tmp 4840 61D7.tmp 4876 6254.tmp 4560 62B1.tmp 4304 630F.tmp 3944 635D.tmp 4564 63AB.tmp 4064 63FA.tmp 2836 6457.tmp 3748 64A5.tmp 1640 64F4.tmp 1300 6551.tmp 2684 65AF.tmp 4992 65FD.tmp 4968 665B.tmp 4328 66B9.tmp 1604 6716.tmp 4456 6774.tmp 4348 67D2.tmp 4368 6830.tmp 3868 688D.tmp 2448 68DC.tmp 1516 6939.tmp 3024 6987.tmp 5048 69E5.tmp 3900 6A33.tmp 2656 6A81.tmp 528 6ADF.tmp 1408 6B2D.tmp 1720 6B7B.tmp 5028 6BCA.tmp 2584 6C18.tmp 2368 6C66.tmp 1008 6CB4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4276 3868 2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe 81 PID 3868 wrote to memory of 4276 3868 2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe 81 PID 3868 wrote to memory of 4276 3868 2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe 81 PID 4276 wrote to memory of 1288 4276 54B7.tmp 82 PID 4276 wrote to memory of 1288 4276 54B7.tmp 82 PID 4276 wrote to memory of 1288 4276 54B7.tmp 82 PID 1288 wrote to memory of 4460 1288 5525.tmp 84 PID 1288 wrote to memory of 4460 1288 5525.tmp 84 PID 1288 wrote to memory of 4460 1288 5525.tmp 84 PID 4460 wrote to memory of 440 4460 55A2.tmp 86 PID 4460 wrote to memory of 440 4460 55A2.tmp 86 PID 4460 wrote to memory of 440 4460 55A2.tmp 86 PID 440 wrote to memory of 376 440 560F.tmp 88 PID 440 wrote to memory of 376 440 560F.tmp 88 PID 440 wrote to memory of 376 440 560F.tmp 88 PID 376 wrote to memory of 4248 376 568C.tmp 89 PID 376 wrote to memory of 4248 376 568C.tmp 89 PID 376 wrote to memory of 4248 376 568C.tmp 89 PID 4248 wrote to memory of 3772 4248 5709.tmp 90 PID 4248 wrote to memory of 3772 4248 5709.tmp 90 PID 4248 wrote to memory of 3772 4248 5709.tmp 90 PID 3772 wrote to memory of 1236 3772 5776.tmp 91 PID 3772 wrote to memory of 1236 3772 5776.tmp 91 PID 3772 wrote to memory of 1236 3772 5776.tmp 91 PID 1236 wrote to memory of 1576 1236 5803.tmp 92 PID 1236 wrote to memory of 1576 1236 5803.tmp 92 PID 1236 wrote to memory of 1576 1236 5803.tmp 92 PID 1576 wrote to memory of 4932 1576 5870.tmp 93 PID 1576 wrote to memory of 4932 1576 5870.tmp 93 PID 1576 wrote to memory of 4932 1576 5870.tmp 93 PID 4932 wrote to memory of 2892 4932 58CE.tmp 94 PID 4932 wrote to memory of 2892 4932 58CE.tmp 94 PID 4932 wrote to memory of 2892 4932 58CE.tmp 94 PID 2892 wrote to memory of 664 2892 592C.tmp 95 PID 2892 wrote to memory of 664 2892 592C.tmp 95 PID 2892 wrote to memory of 664 2892 592C.tmp 95 PID 664 wrote to memory of 1148 664 598A.tmp 96 PID 664 wrote to memory of 1148 664 598A.tmp 96 PID 664 wrote to memory of 1148 664 598A.tmp 96 PID 1148 wrote to memory of 3880 1148 59F7.tmp 97 PID 1148 wrote to memory of 3880 1148 59F7.tmp 97 PID 1148 wrote to memory of 3880 1148 59F7.tmp 97 PID 3880 wrote to memory of 3308 3880 5A45.tmp 98 PID 3880 wrote to memory of 3308 3880 5A45.tmp 98 PID 3880 wrote to memory of 3308 3880 5A45.tmp 98 PID 3308 wrote to memory of 3204 3308 5AC2.tmp 99 PID 3308 wrote to memory of 3204 3308 5AC2.tmp 99 PID 3308 wrote to memory of 3204 3308 5AC2.tmp 99 PID 3204 wrote to memory of 3740 3204 5B3F.tmp 100 PID 3204 wrote to memory of 3740 3204 5B3F.tmp 100 PID 3204 wrote to memory of 3740 3204 5B3F.tmp 100 PID 3740 wrote to memory of 1764 3740 5B8D.tmp 101 PID 3740 wrote to memory of 1764 3740 5B8D.tmp 101 PID 3740 wrote to memory of 1764 3740 5B8D.tmp 101 PID 1764 wrote to memory of 4104 1764 5C2A.tmp 102 PID 1764 wrote to memory of 4104 1764 5C2A.tmp 102 PID 1764 wrote to memory of 4104 1764 5C2A.tmp 102 PID 4104 wrote to memory of 3788 4104 5C97.tmp 103 PID 4104 wrote to memory of 3788 4104 5C97.tmp 103 PID 4104 wrote to memory of 3788 4104 5C97.tmp 103 PID 3788 wrote to memory of 3108 3788 5D24.tmp 104 PID 3788 wrote to memory of 3108 3788 5D24.tmp 104 PID 3788 wrote to memory of 3108 3788 5D24.tmp 104 PID 3108 wrote to memory of 1948 3108 5DA1.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_dd46b7dd659405f1a491a624e99bd2f9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"23⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"24⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"25⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"26⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"27⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"28⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"29⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"30⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"31⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"32⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"33⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"34⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"35⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"36⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"37⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"38⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"39⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"40⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"41⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"42⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"43⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"44⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"45⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"46⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"47⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"48⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"49⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"50⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"51⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"52⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"53⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"54⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"55⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"56⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"57⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"58⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"59⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"60⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"61⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"62⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"63⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"64⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"65⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"66⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"67⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"68⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"69⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"70⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"71⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"72⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"73⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"74⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"75⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"76⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"78⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"79⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"80⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"81⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"82⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"83⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"84⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"85⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"86⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"87⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"88⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"89⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"90⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"91⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"92⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"93⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"94⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"95⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"96⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"97⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"98⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"99⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"100⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"101⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"102⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"103⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"104⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"105⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"106⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"107⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"108⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"109⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"110⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"111⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"112⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"113⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"114⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"115⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"116⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"117⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"118⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"119⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"120⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"121⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"122⤵PID:4616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-