Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe
-
Size
529KB
-
MD5
6c04ade2faf2db8bd0a6bc4585bdba66
-
SHA1
ff11f3a45852082ba20062eb204b8151acddc80a
-
SHA256
efd7c6807b5f23cb3b8da55cfad8e62663de5d2c2eee24eff451f669ad7abeca
-
SHA512
211028ab8d4d02f4548df8560f443435e073fae2102842dd6117ea99d4cc7bc75547882e582e7a5ecef8fe9a83e71d94b14e738453e11b3157b98283d0f5dd9f
-
SSDEEP
12288:NU5rCOTeij3SnrSabw/KSTYT614nagp3e0TZwlH4Hp:NUQOJj3/MTcgJ1TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
C6F.tmpCFB.tmpD59.tmpDC6.tmpE34.tmpEA1.tmpF0E.tmpF6C.tmpFCA.tmp1047.tmp10B4.tmp1112.tmp117F.tmp11DD.tmp123B.tmp12D7.tmp1325.tmp1373.tmp13E1.tmp143F.tmp149C.tmp1519.tmp1596.tmp1623.tmp1671.tmp170D.tmp177B.tmp17E8.tmp1865.tmp18D2.tmp1930.tmp198E.tmp19FB.tmp1A49.tmp1A98.tmp1AF5.tmp1B43.tmp1B92.tmp1BEF.tmp1C4D.tmp1CAB.tmp1CF9.tmp1D57.tmp1DA5.tmp1DF3.tmp1E51.tmp1EAE.tmp1F0C.tmp1F6A.tmp1FB8.tmp2016.tmp2064.tmp20C2.tmp211F.tmp217D.tmp21DB.tmp2239.tmp2296.tmp22F4.tmp2352.tmp23B0.tmp240D.tmp246B.tmp24C9.tmppid process 2892 C6F.tmp 2792 CFB.tmp 4628 D59.tmp 1748 DC6.tmp 4556 E34.tmp 448 EA1.tmp 2980 F0E.tmp 2860 F6C.tmp 2812 FCA.tmp 4808 1047.tmp 3564 10B4.tmp 1016 1112.tmp 4976 117F.tmp 3740 11DD.tmp 3128 123B.tmp 384 12D7.tmp 656 1325.tmp 4344 1373.tmp 4952 13E1.tmp 3716 143F.tmp 3324 149C.tmp 3684 1519.tmp 2504 1596.tmp 2972 1623.tmp 2900 1671.tmp 4852 170D.tmp 4896 177B.tmp 2144 17E8.tmp 1408 1865.tmp 3156 18D2.tmp 3572 1930.tmp 1632 198E.tmp 2408 19FB.tmp 4696 1A49.tmp 2388 1A98.tmp 4820 1AF5.tmp 3940 1B43.tmp 2888 1B92.tmp 2844 1BEF.tmp 2940 1C4D.tmp 5064 1CAB.tmp 4496 1CF9.tmp 924 1D57.tmp 3168 1DA5.tmp 3512 1DF3.tmp 1484 1E51.tmp 1288 1EAE.tmp 2188 1F0C.tmp 436 1F6A.tmp 3096 1FB8.tmp 3188 2016.tmp 772 2064.tmp 1672 20C2.tmp 116 211F.tmp 3380 217D.tmp 4648 21DB.tmp 5044 2239.tmp 1408 2296.tmp 3864 22F4.tmp 4040 2352.tmp 2692 23B0.tmp 2528 240D.tmp 4444 246B.tmp 2280 24C9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exeC6F.tmpCFB.tmpD59.tmpDC6.tmpE34.tmpEA1.tmpF0E.tmpF6C.tmpFCA.tmp1047.tmp10B4.tmp1112.tmp117F.tmp11DD.tmp123B.tmp12D7.tmp1325.tmp1373.tmp13E1.tmp143F.tmp149C.tmpdescription pid process target process PID 1408 wrote to memory of 2892 1408 2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe C6F.tmp PID 1408 wrote to memory of 2892 1408 2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe C6F.tmp PID 1408 wrote to memory of 2892 1408 2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe C6F.tmp PID 2892 wrote to memory of 2792 2892 C6F.tmp CFB.tmp PID 2892 wrote to memory of 2792 2892 C6F.tmp CFB.tmp PID 2892 wrote to memory of 2792 2892 C6F.tmp CFB.tmp PID 2792 wrote to memory of 4628 2792 CFB.tmp D59.tmp PID 2792 wrote to memory of 4628 2792 CFB.tmp D59.tmp PID 2792 wrote to memory of 4628 2792 CFB.tmp D59.tmp PID 4628 wrote to memory of 1748 4628 D59.tmp DC6.tmp PID 4628 wrote to memory of 1748 4628 D59.tmp DC6.tmp PID 4628 wrote to memory of 1748 4628 D59.tmp DC6.tmp PID 1748 wrote to memory of 4556 1748 DC6.tmp E34.tmp PID 1748 wrote to memory of 4556 1748 DC6.tmp E34.tmp PID 1748 wrote to memory of 4556 1748 DC6.tmp E34.tmp PID 4556 wrote to memory of 448 4556 E34.tmp EA1.tmp PID 4556 wrote to memory of 448 4556 E34.tmp EA1.tmp PID 4556 wrote to memory of 448 4556 E34.tmp EA1.tmp PID 448 wrote to memory of 2980 448 EA1.tmp F0E.tmp PID 448 wrote to memory of 2980 448 EA1.tmp F0E.tmp PID 448 wrote to memory of 2980 448 EA1.tmp F0E.tmp PID 2980 wrote to memory of 2860 2980 F0E.tmp F6C.tmp PID 2980 wrote to memory of 2860 2980 F0E.tmp F6C.tmp PID 2980 wrote to memory of 2860 2980 F0E.tmp F6C.tmp PID 2860 wrote to memory of 2812 2860 F6C.tmp FCA.tmp PID 2860 wrote to memory of 2812 2860 F6C.tmp FCA.tmp PID 2860 wrote to memory of 2812 2860 F6C.tmp FCA.tmp PID 2812 wrote to memory of 4808 2812 FCA.tmp 1047.tmp PID 2812 wrote to memory of 4808 2812 FCA.tmp 1047.tmp PID 2812 wrote to memory of 4808 2812 FCA.tmp 1047.tmp PID 4808 wrote to memory of 3564 4808 1047.tmp 10B4.tmp PID 4808 wrote to memory of 3564 4808 1047.tmp 10B4.tmp PID 4808 wrote to memory of 3564 4808 1047.tmp 10B4.tmp PID 3564 wrote to memory of 1016 3564 10B4.tmp 1112.tmp PID 3564 wrote to memory of 1016 3564 10B4.tmp 1112.tmp PID 3564 wrote to memory of 1016 3564 10B4.tmp 1112.tmp PID 1016 wrote to memory of 4976 1016 1112.tmp 117F.tmp PID 1016 wrote to memory of 4976 1016 1112.tmp 117F.tmp PID 1016 wrote to memory of 4976 1016 1112.tmp 117F.tmp PID 4976 wrote to memory of 3740 4976 117F.tmp 11DD.tmp PID 4976 wrote to memory of 3740 4976 117F.tmp 11DD.tmp PID 4976 wrote to memory of 3740 4976 117F.tmp 11DD.tmp PID 3740 wrote to memory of 3128 3740 11DD.tmp 123B.tmp PID 3740 wrote to memory of 3128 3740 11DD.tmp 123B.tmp PID 3740 wrote to memory of 3128 3740 11DD.tmp 123B.tmp PID 3128 wrote to memory of 384 3128 123B.tmp 12D7.tmp PID 3128 wrote to memory of 384 3128 123B.tmp 12D7.tmp PID 3128 wrote to memory of 384 3128 123B.tmp 12D7.tmp PID 384 wrote to memory of 656 384 12D7.tmp 1325.tmp PID 384 wrote to memory of 656 384 12D7.tmp 1325.tmp PID 384 wrote to memory of 656 384 12D7.tmp 1325.tmp PID 656 wrote to memory of 4344 656 1325.tmp 1373.tmp PID 656 wrote to memory of 4344 656 1325.tmp 1373.tmp PID 656 wrote to memory of 4344 656 1325.tmp 1373.tmp PID 4344 wrote to memory of 4952 4344 1373.tmp 13E1.tmp PID 4344 wrote to memory of 4952 4344 1373.tmp 13E1.tmp PID 4344 wrote to memory of 4952 4344 1373.tmp 13E1.tmp PID 4952 wrote to memory of 3716 4952 13E1.tmp 143F.tmp PID 4952 wrote to memory of 3716 4952 13E1.tmp 143F.tmp PID 4952 wrote to memory of 3716 4952 13E1.tmp 143F.tmp PID 3716 wrote to memory of 3324 3716 143F.tmp 149C.tmp PID 3716 wrote to memory of 3324 3716 143F.tmp 149C.tmp PID 3716 wrote to memory of 3324 3716 143F.tmp 149C.tmp PID 3324 wrote to memory of 3684 3324 149C.tmp 1519.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_6c04ade2faf2db8bd0a6bc4585bdba66_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"23⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"24⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"25⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"26⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"27⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"28⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"29⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"30⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"31⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"32⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"33⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"34⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"35⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"36⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"37⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"38⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"39⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"40⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"41⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"42⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"43⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"44⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"45⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"46⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"47⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"48⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"49⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"50⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"51⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"52⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"53⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"54⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"55⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"56⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"57⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"58⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"59⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"60⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"61⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"62⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"63⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"64⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"65⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"66⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"67⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"68⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"69⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"70⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"71⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"72⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"73⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"74⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"75⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"76⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"77⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"78⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"80⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"81⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"82⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"84⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"85⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"86⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"87⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"88⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"89⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"90⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"91⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"92⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"93⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"94⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"95⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"96⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"97⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"98⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"99⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"100⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"101⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"102⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"103⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"104⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"105⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"106⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"107⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"108⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"109⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"110⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"111⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"113⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"114⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"115⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"116⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"117⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"118⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"119⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"120⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"121⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"122⤵PID:4896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-