Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe
-
Size
529KB
-
MD5
9a61d375062e6066500deffa3608b059
-
SHA1
abd7089b83638f67fb6d303460f501f7bb1842ef
-
SHA256
500de9ba156d0fb3194834e6bd91312cca25768a8ec8be9de541169a65d3ca26
-
SHA512
dec7351c5e1b3ead30c1ac8b649edba34fa84133ff153089021424463836a83c4a07aadd349ae4c88364f5a2cb8d9d4b3b069189709e078a2ec489c1ab398414
-
SSDEEP
12288:NU5rCOTeijwWqEdlKcPi24ErLv1lzKMTZwlH4Hp:NUQOJjL3iurLt9TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3632 4DB2.tmp 1500 4E2F.tmp 3932 4EBC.tmp 5040 4F97.tmp 1052 5023.tmp 4336 50CF.tmp 920 513D.tmp 4344 51AA.tmp 988 5237.tmp 1400 52B4.tmp 4792 5360.tmp 1068 53DD.tmp 1984 544A.tmp 3668 54D7.tmp 1584 5534.tmp 1128 55B1.tmp 4332 564E.tmp 4820 56BB.tmp 4928 5757.tmp 3660 57C5.tmp 1800 5822.tmp 3488 5890.tmp 3396 594B.tmp 1392 59B9.tmp 2136 5A36.tmp 3092 5AA3.tmp 5036 5B30.tmp 4180 5BCC.tmp 4592 5C39.tmp 2700 5CB6.tmp 4724 5D14.tmp 1580 5DB0.tmp 4628 5DFE.tmp 3340 5E5C.tmp 4904 5EBA.tmp 2380 5F18.tmp 3872 5F66.tmp 1256 5FB4.tmp 388 6002.tmp 1960 6050.tmp 1760 60BD.tmp 4372 610C.tmp 4524 6179.tmp 3568 61C7.tmp 2104 6225.tmp 4364 6273.tmp 3356 62D1.tmp 2952 632E.tmp 3144 638C.tmp 2492 63EA.tmp 4284 6457.tmp 3640 64C5.tmp 3732 6513.tmp 1768 6561.tmp 3620 65DE.tmp 3052 664B.tmp 2744 66A9.tmp 1496 66F7.tmp 688 6765.tmp 2156 67D2.tmp 2972 6830.tmp 4616 687E.tmp 1156 68EB.tmp 1068 6959.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3568 wrote to memory of 3632 3568 2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe 82 PID 3568 wrote to memory of 3632 3568 2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe 82 PID 3568 wrote to memory of 3632 3568 2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe 82 PID 3632 wrote to memory of 1500 3632 4DB2.tmp 83 PID 3632 wrote to memory of 1500 3632 4DB2.tmp 83 PID 3632 wrote to memory of 1500 3632 4DB2.tmp 83 PID 1500 wrote to memory of 3932 1500 4E2F.tmp 85 PID 1500 wrote to memory of 3932 1500 4E2F.tmp 85 PID 1500 wrote to memory of 3932 1500 4E2F.tmp 85 PID 3932 wrote to memory of 5040 3932 4EBC.tmp 87 PID 3932 wrote to memory of 5040 3932 4EBC.tmp 87 PID 3932 wrote to memory of 5040 3932 4EBC.tmp 87 PID 5040 wrote to memory of 1052 5040 4F97.tmp 89 PID 5040 wrote to memory of 1052 5040 4F97.tmp 89 PID 5040 wrote to memory of 1052 5040 4F97.tmp 89 PID 1052 wrote to memory of 4336 1052 5023.tmp 90 PID 1052 wrote to memory of 4336 1052 5023.tmp 90 PID 1052 wrote to memory of 4336 1052 5023.tmp 90 PID 4336 wrote to memory of 920 4336 50CF.tmp 91 PID 4336 wrote to memory of 920 4336 50CF.tmp 91 PID 4336 wrote to memory of 920 4336 50CF.tmp 91 PID 920 wrote to memory of 4344 920 513D.tmp 92 PID 920 wrote to memory of 4344 920 513D.tmp 92 PID 920 wrote to memory of 4344 920 513D.tmp 92 PID 4344 wrote to memory of 988 4344 51AA.tmp 93 PID 4344 wrote to memory of 988 4344 51AA.tmp 93 PID 4344 wrote to memory of 988 4344 51AA.tmp 93 PID 988 wrote to memory of 1400 988 5237.tmp 94 PID 988 wrote to memory of 1400 988 5237.tmp 94 PID 988 wrote to memory of 1400 988 5237.tmp 94 PID 1400 wrote to memory of 4792 1400 52B4.tmp 95 PID 1400 wrote to memory of 4792 1400 52B4.tmp 95 PID 1400 wrote to memory of 4792 1400 52B4.tmp 95 PID 4792 wrote to memory of 1068 4792 5360.tmp 96 PID 4792 wrote to memory of 1068 4792 5360.tmp 96 PID 4792 wrote to memory of 1068 4792 5360.tmp 96 PID 1068 wrote to memory of 1984 1068 53DD.tmp 97 PID 1068 wrote to memory of 1984 1068 53DD.tmp 97 PID 1068 wrote to memory of 1984 1068 53DD.tmp 97 PID 1984 wrote to memory of 3668 1984 544A.tmp 98 PID 1984 wrote to memory of 3668 1984 544A.tmp 98 PID 1984 wrote to memory of 3668 1984 544A.tmp 98 PID 3668 wrote to memory of 1584 3668 54D7.tmp 99 PID 3668 wrote to memory of 1584 3668 54D7.tmp 99 PID 3668 wrote to memory of 1584 3668 54D7.tmp 99 PID 1584 wrote to memory of 1128 1584 5534.tmp 100 PID 1584 wrote to memory of 1128 1584 5534.tmp 100 PID 1584 wrote to memory of 1128 1584 5534.tmp 100 PID 1128 wrote to memory of 4332 1128 55B1.tmp 101 PID 1128 wrote to memory of 4332 1128 55B1.tmp 101 PID 1128 wrote to memory of 4332 1128 55B1.tmp 101 PID 4332 wrote to memory of 4820 4332 564E.tmp 102 PID 4332 wrote to memory of 4820 4332 564E.tmp 102 PID 4332 wrote to memory of 4820 4332 564E.tmp 102 PID 4820 wrote to memory of 4928 4820 56BB.tmp 103 PID 4820 wrote to memory of 4928 4820 56BB.tmp 103 PID 4820 wrote to memory of 4928 4820 56BB.tmp 103 PID 4928 wrote to memory of 3660 4928 5757.tmp 104 PID 4928 wrote to memory of 3660 4928 5757.tmp 104 PID 4928 wrote to memory of 3660 4928 5757.tmp 104 PID 3660 wrote to memory of 1800 3660 57C5.tmp 105 PID 3660 wrote to memory of 1800 3660 57C5.tmp 105 PID 3660 wrote to memory of 1800 3660 57C5.tmp 105 PID 1800 wrote to memory of 3488 1800 5822.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_9a61d375062e6066500deffa3608b059_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"23⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"24⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"25⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"26⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"27⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"28⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"29⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"30⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"31⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"32⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"33⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"34⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"35⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"36⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"37⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"38⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"39⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"40⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"41⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"42⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"43⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"44⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"45⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"46⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"47⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"48⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"49⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"50⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"51⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"52⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"53⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"54⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"55⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"56⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"57⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"58⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"59⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"60⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"61⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"62⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"63⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"64⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"65⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"66⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"67⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"68⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"69⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"70⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"71⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"72⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"73⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"74⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"75⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"76⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"77⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"78⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"79⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"80⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"81⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"82⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"84⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"85⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"86⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"87⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"88⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"89⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"90⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"91⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"92⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"93⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"94⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"95⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"96⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"97⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"98⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"99⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"100⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"101⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"102⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"103⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"104⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"105⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"106⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"107⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"108⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"109⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"110⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"111⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"112⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"113⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"114⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"115⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"116⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"117⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"118⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"119⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"120⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"121⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"122⤵PID:4932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-