Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe
-
Size
487KB
-
MD5
b7598f457e023962f1c5f68c3be87c61
-
SHA1
e5d577cb17fe88a8b59064d0cf95cbf1edea443a
-
SHA256
84f11d3e5b8fb92bf00c95f9dde4b4ee413f59f41f9e17f6a360ee0d206c61b5
-
SHA512
0be1922a4ec9e6de55789f7b44231c4ceb83baff46ccf97d4ea69bc779c32fac936101751accf39aa22c6eb2eda5cde99c5a65daa183443d56a3465c7705c189
-
SSDEEP
12288:yU5rCOTeiNNUihdgMhNN+F4ZHY0nmm5gaQLMbZ:yUQOJNXhdZhXi0HY0SaQLMb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4092 495D.tmp 1140 49DA.tmp 2136 4A57.tmp 4496 4AE4.tmp 1648 4B51.tmp 2040 4BAF.tmp 3228 4C1C.tmp 4968 4C99.tmp 4280 4D26.tmp 5044 4D74.tmp 4156 4DF1.tmp 4944 4E7E.tmp 1764 4EEB.tmp 3180 4F58.tmp 3756 4FC6.tmp 216 5043.tmp 3976 50A0.tmp 2140 50FE.tmp 4380 515C.tmp 3260 51D9.tmp 1588 5256.tmp 4516 52B4.tmp 1768 5331.tmp 604 53BD.tmp 1060 541B.tmp 4000 5469.tmp 2964 54E6.tmp 3664 5544.tmp 1120 55D1.tmp 4552 562E.tmp 3320 569C.tmp 3544 5728.tmp 4404 5786.tmp 4652 57F3.tmp 2028 5851.tmp 4964 58AF.tmp 4372 58FD.tmp 4444 595B.tmp 4820 59A9.tmp 3192 5A07.tmp 836 5A55.tmp 1640 5AA3.tmp 1596 5B01.tmp 1140 5B5E.tmp 912 5BAD.tmp 1104 5BFB.tmp 5000 5C49.tmp 5088 5CB6.tmp 2116 5D24.tmp 4536 5D81.tmp 4524 5DDF.tmp 2776 5E3D.tmp 4156 5E9B.tmp 4944 5EE9.tmp 1748 5F56.tmp 3152 5FB4.tmp 3180 6012.tmp 3756 6060.tmp 4992 60AE.tmp 4392 610C.tmp 4952 6169.tmp 2876 61C7.tmp 2100 6225.tmp 4088 6292.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 896 wrote to memory of 4092 896 2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe 84 PID 896 wrote to memory of 4092 896 2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe 84 PID 896 wrote to memory of 4092 896 2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe 84 PID 4092 wrote to memory of 1140 4092 495D.tmp 85 PID 4092 wrote to memory of 1140 4092 495D.tmp 85 PID 4092 wrote to memory of 1140 4092 495D.tmp 85 PID 1140 wrote to memory of 2136 1140 49DA.tmp 86 PID 1140 wrote to memory of 2136 1140 49DA.tmp 86 PID 1140 wrote to memory of 2136 1140 49DA.tmp 86 PID 2136 wrote to memory of 4496 2136 4A57.tmp 88 PID 2136 wrote to memory of 4496 2136 4A57.tmp 88 PID 2136 wrote to memory of 4496 2136 4A57.tmp 88 PID 4496 wrote to memory of 1648 4496 4AE4.tmp 89 PID 4496 wrote to memory of 1648 4496 4AE4.tmp 89 PID 4496 wrote to memory of 1648 4496 4AE4.tmp 89 PID 1648 wrote to memory of 2040 1648 4B51.tmp 90 PID 1648 wrote to memory of 2040 1648 4B51.tmp 90 PID 1648 wrote to memory of 2040 1648 4B51.tmp 90 PID 2040 wrote to memory of 3228 2040 4BAF.tmp 92 PID 2040 wrote to memory of 3228 2040 4BAF.tmp 92 PID 2040 wrote to memory of 3228 2040 4BAF.tmp 92 PID 3228 wrote to memory of 4968 3228 4C1C.tmp 94 PID 3228 wrote to memory of 4968 3228 4C1C.tmp 94 PID 3228 wrote to memory of 4968 3228 4C1C.tmp 94 PID 4968 wrote to memory of 4280 4968 4C99.tmp 95 PID 4968 wrote to memory of 4280 4968 4C99.tmp 95 PID 4968 wrote to memory of 4280 4968 4C99.tmp 95 PID 4280 wrote to memory of 5044 4280 4D26.tmp 96 PID 4280 wrote to memory of 5044 4280 4D26.tmp 96 PID 4280 wrote to memory of 5044 4280 4D26.tmp 96 PID 5044 wrote to memory of 4156 5044 4D74.tmp 97 PID 5044 wrote to memory of 4156 5044 4D74.tmp 97 PID 5044 wrote to memory of 4156 5044 4D74.tmp 97 PID 4156 wrote to memory of 4944 4156 4DF1.tmp 98 PID 4156 wrote to memory of 4944 4156 4DF1.tmp 98 PID 4156 wrote to memory of 4944 4156 4DF1.tmp 98 PID 4944 wrote to memory of 1764 4944 4E7E.tmp 99 PID 4944 wrote to memory of 1764 4944 4E7E.tmp 99 PID 4944 wrote to memory of 1764 4944 4E7E.tmp 99 PID 1764 wrote to memory of 3180 1764 4EEB.tmp 100 PID 1764 wrote to memory of 3180 1764 4EEB.tmp 100 PID 1764 wrote to memory of 3180 1764 4EEB.tmp 100 PID 3180 wrote to memory of 3756 3180 4F58.tmp 101 PID 3180 wrote to memory of 3756 3180 4F58.tmp 101 PID 3180 wrote to memory of 3756 3180 4F58.tmp 101 PID 3756 wrote to memory of 216 3756 4FC6.tmp 102 PID 3756 wrote to memory of 216 3756 4FC6.tmp 102 PID 3756 wrote to memory of 216 3756 4FC6.tmp 102 PID 216 wrote to memory of 3976 216 5043.tmp 103 PID 216 wrote to memory of 3976 216 5043.tmp 103 PID 216 wrote to memory of 3976 216 5043.tmp 103 PID 3976 wrote to memory of 2140 3976 50A0.tmp 104 PID 3976 wrote to memory of 2140 3976 50A0.tmp 104 PID 3976 wrote to memory of 2140 3976 50A0.tmp 104 PID 2140 wrote to memory of 4380 2140 50FE.tmp 105 PID 2140 wrote to memory of 4380 2140 50FE.tmp 105 PID 2140 wrote to memory of 4380 2140 50FE.tmp 105 PID 4380 wrote to memory of 3260 4380 515C.tmp 106 PID 4380 wrote to memory of 3260 4380 515C.tmp 106 PID 4380 wrote to memory of 3260 4380 515C.tmp 106 PID 3260 wrote to memory of 1588 3260 51D9.tmp 107 PID 3260 wrote to memory of 1588 3260 51D9.tmp 107 PID 3260 wrote to memory of 1588 3260 51D9.tmp 107 PID 1588 wrote to memory of 4516 1588 5256.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_b7598f457e023962f1c5f68c3be87c61_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"23⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"24⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"25⤵
- Executes dropped EXE
PID:604 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"26⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"27⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"28⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"29⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"30⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"31⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"32⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"33⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"34⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"35⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"36⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"37⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"38⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"39⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"40⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"41⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"42⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"43⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"44⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"45⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"46⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"47⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"48⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"49⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"50⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"51⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"52⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"53⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"54⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"55⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"56⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"57⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"58⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"59⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"60⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"61⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"62⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"63⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"64⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"65⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"66⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"67⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"68⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"69⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"70⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"71⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"72⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"73⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"74⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"75⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"76⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"77⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"78⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"79⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"80⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"81⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"82⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"83⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"85⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"86⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"87⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"88⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"89⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"90⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"92⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"93⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"94⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"95⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"96⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"97⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"98⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"99⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"100⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"101⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"102⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"103⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"104⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"106⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"108⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"109⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"110⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"111⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"112⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"113⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"114⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"115⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"116⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"117⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"118⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"119⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"120⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"121⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-