Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe
-
Size
712KB
-
MD5
99a564f585d1f2c1b0e4d1c84aaff5d1
-
SHA1
b3181bd71d39da3c0ae08ded1a96c10ed749b028
-
SHA256
59b2fa9a499ce37264abcc3d1437b0360a5e0331135dc90d58c06d240407be58
-
SHA512
ae7e5ad2003e2334c5016bbe69fef5b92751b1c59cd2dfdfae7bc3577b288e41c038300d364ea68ab050b8cf27095d47d222d50cb4c4adc0bab0f619b3b9d969
-
SSDEEP
12288:FU5rCOTeiDopG65kTpoFDhBAi1FmzNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzN0:FUQOJDopG657UDNnCvq5TJLCvY90D8/V
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 232 46EC.tmp 3452 4759.tmp 2612 47B7.tmp 2508 4863.tmp 2828 48FF.tmp 4308 496D.tmp 2000 49CA.tmp 3192 4A67.tmp 3356 4AE4.tmp 1920 4B51.tmp 4240 4BAF.tmp 2824 4C1C.tmp 2328 4C8A.tmp 4916 4CF7.tmp 4216 4D55.tmp 1060 4DD2.tmp 2720 4E3F.tmp 2792 4EAC.tmp 4356 4F29.tmp 1912 4FB6.tmp 432 5014.tmp 492 5091.tmp 3288 511D.tmp 544 517B.tmp 3584 51E9.tmp 2464 5266.tmp 1128 52D3.tmp 1400 5350.tmp 568 53CD.tmp 1648 541B.tmp 2468 5498.tmp 4580 5505.tmp 3776 5582.tmp 3516 55F0.tmp 4004 563E.tmp 2600 569C.tmp 524 56F9.tmp 3396 5748.tmp 3344 57A5.tmp 3004 5803.tmp 4284 5851.tmp 2040 589F.tmp 2932 58FD.tmp 2988 594B.tmp 3452 59A9.tmp 1904 5A07.tmp 3216 5A74.tmp 3188 5AD2.tmp 2472 5B30.tmp 1988 5B7E.tmp 364 5BDB.tmp 2856 5C49.tmp 1156 5CA7.tmp 5040 5D04.tmp 4052 5D72.tmp 3976 5DCF.tmp 3604 5E2D.tmp 2072 5E8B.tmp 1560 5ED9.tmp 4624 5F37.tmp 2908 5F95.tmp 3180 5FF2.tmp 4868 6050.tmp 632 60AE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 232 4976 2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe 82 PID 4976 wrote to memory of 232 4976 2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe 82 PID 4976 wrote to memory of 232 4976 2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe 82 PID 232 wrote to memory of 3452 232 46EC.tmp 83 PID 232 wrote to memory of 3452 232 46EC.tmp 83 PID 232 wrote to memory of 3452 232 46EC.tmp 83 PID 3452 wrote to memory of 2612 3452 4759.tmp 85 PID 3452 wrote to memory of 2612 3452 4759.tmp 85 PID 3452 wrote to memory of 2612 3452 4759.tmp 85 PID 2612 wrote to memory of 2508 2612 47B7.tmp 87 PID 2612 wrote to memory of 2508 2612 47B7.tmp 87 PID 2612 wrote to memory of 2508 2612 47B7.tmp 87 PID 2508 wrote to memory of 2828 2508 4863.tmp 89 PID 2508 wrote to memory of 2828 2508 4863.tmp 89 PID 2508 wrote to memory of 2828 2508 4863.tmp 89 PID 2828 wrote to memory of 4308 2828 48FF.tmp 90 PID 2828 wrote to memory of 4308 2828 48FF.tmp 90 PID 2828 wrote to memory of 4308 2828 48FF.tmp 90 PID 4308 wrote to memory of 2000 4308 496D.tmp 91 PID 4308 wrote to memory of 2000 4308 496D.tmp 91 PID 4308 wrote to memory of 2000 4308 496D.tmp 91 PID 2000 wrote to memory of 3192 2000 49CA.tmp 92 PID 2000 wrote to memory of 3192 2000 49CA.tmp 92 PID 2000 wrote to memory of 3192 2000 49CA.tmp 92 PID 3192 wrote to memory of 3356 3192 4A67.tmp 93 PID 3192 wrote to memory of 3356 3192 4A67.tmp 93 PID 3192 wrote to memory of 3356 3192 4A67.tmp 93 PID 3356 wrote to memory of 1920 3356 4AE4.tmp 94 PID 3356 wrote to memory of 1920 3356 4AE4.tmp 94 PID 3356 wrote to memory of 1920 3356 4AE4.tmp 94 PID 1920 wrote to memory of 4240 1920 4B51.tmp 95 PID 1920 wrote to memory of 4240 1920 4B51.tmp 95 PID 1920 wrote to memory of 4240 1920 4B51.tmp 95 PID 4240 wrote to memory of 2824 4240 4BAF.tmp 96 PID 4240 wrote to memory of 2824 4240 4BAF.tmp 96 PID 4240 wrote to memory of 2824 4240 4BAF.tmp 96 PID 2824 wrote to memory of 2328 2824 4C1C.tmp 97 PID 2824 wrote to memory of 2328 2824 4C1C.tmp 97 PID 2824 wrote to memory of 2328 2824 4C1C.tmp 97 PID 2328 wrote to memory of 4916 2328 4C8A.tmp 98 PID 2328 wrote to memory of 4916 2328 4C8A.tmp 98 PID 2328 wrote to memory of 4916 2328 4C8A.tmp 98 PID 4916 wrote to memory of 4216 4916 4CF7.tmp 99 PID 4916 wrote to memory of 4216 4916 4CF7.tmp 99 PID 4916 wrote to memory of 4216 4916 4CF7.tmp 99 PID 4216 wrote to memory of 1060 4216 4D55.tmp 100 PID 4216 wrote to memory of 1060 4216 4D55.tmp 100 PID 4216 wrote to memory of 1060 4216 4D55.tmp 100 PID 1060 wrote to memory of 2720 1060 4DD2.tmp 101 PID 1060 wrote to memory of 2720 1060 4DD2.tmp 101 PID 1060 wrote to memory of 2720 1060 4DD2.tmp 101 PID 2720 wrote to memory of 2792 2720 4E3F.tmp 102 PID 2720 wrote to memory of 2792 2720 4E3F.tmp 102 PID 2720 wrote to memory of 2792 2720 4E3F.tmp 102 PID 2792 wrote to memory of 4356 2792 4EAC.tmp 103 PID 2792 wrote to memory of 4356 2792 4EAC.tmp 103 PID 2792 wrote to memory of 4356 2792 4EAC.tmp 103 PID 4356 wrote to memory of 1912 4356 4F29.tmp 104 PID 4356 wrote to memory of 1912 4356 4F29.tmp 104 PID 4356 wrote to memory of 1912 4356 4F29.tmp 104 PID 1912 wrote to memory of 432 1912 4FB6.tmp 105 PID 1912 wrote to memory of 432 1912 4FB6.tmp 105 PID 1912 wrote to memory of 432 1912 4FB6.tmp 105 PID 432 wrote to memory of 492 432 5014.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_99a564f585d1f2c1b0e4d1c84aaff5d1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"23⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"24⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"25⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"26⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"27⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"28⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"29⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"30⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"31⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"32⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"33⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"34⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"35⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"36⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"37⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"38⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"39⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"40⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"41⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"42⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"43⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"44⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"45⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"46⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"47⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"48⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"49⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"50⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"51⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"52⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"53⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"54⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"55⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"56⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"57⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"58⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"59⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"60⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"61⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"62⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"63⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"64⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"65⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"66⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"67⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"68⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"69⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"70⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"71⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"72⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"73⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"74⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"75⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"76⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"77⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"78⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"79⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"80⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"81⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"82⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"83⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"84⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"85⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"86⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"87⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"88⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"89⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"90⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"91⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"92⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"93⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"94⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"95⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"96⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"97⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"98⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"99⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"100⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"101⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"102⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"103⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"104⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"105⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"106⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"107⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"108⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"109⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"110⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"111⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"112⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"113⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"114⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"115⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"116⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"117⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"118⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"119⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"120⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"121⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"122⤵PID:1060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-