Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 07:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe
-
Size
541KB
-
MD5
5d8f84cf83718c6a004e1ba7b6d6d70b
-
SHA1
decef4a635c311c70b6fd3ea6effffcebf0aa1f3
-
SHA256
5aa03b57dddb4a5183415bc76da6715359b8052812c3e6e5c5c3a968a2101f29
-
SHA512
a151770b9f0509612973c9ce1257df4da2467fbd6c84e02076205f0f545439604b73380ce64c13c4ba1c1457c6673aaba97e62737ff2cc3b4485b0e7de129404
-
SSDEEP
12288:UU5rCOTeifIp7bYbHMbNCzxOz2/TMUWVJRl0z2rZa73ctO:UUQOJfO3oHPxxYVVVw2rU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3432 3CDA.tmp 1320 3D57.tmp 2300 3DC4.tmp 540 3E32.tmp 2796 3E80.tmp 2188 3ECE.tmp 4836 3F1C.tmp 2616 3F6A.tmp 5004 3FB8.tmp 1972 4006.tmp 3888 4055.tmp 3484 40B2.tmp 3668 4100.tmp 2580 415E.tmp 4564 41BC.tmp 2252 421A.tmp 3096 4277.tmp 1988 42C6.tmp 2204 4323.tmp 100 4381.tmp 3736 43DF.tmp 4208 443D.tmp 4660 448B.tmp 388 44D9.tmp 4864 4537.tmp 216 4585.tmp 2368 45D3.tmp 2836 4621.tmp 1996 467F.tmp 2396 46CD.tmp 1864 472B.tmp 3240 4798.tmp 3448 47E6.tmp 4588 4863.tmp 4752 48C1.tmp 4552 490F.tmp 2284 495D.tmp 4692 49AB.tmp 4488 4A38.tmp 4792 4AC4.tmp 1060 4B61.tmp 1916 4BBE.tmp 4780 4C2C.tmp 452 4CD8.tmp 2452 4D64.tmp 3532 4DC2.tmp 3696 4E20.tmp 4604 4E6E.tmp 2508 4EBC.tmp 4324 4F1A.tmp 1520 4F78.tmp 2988 4FC6.tmp 3292 5033.tmp 1540 5081.tmp 4720 50CF.tmp 4860 511D.tmp 4928 517B.tmp 1472 51D9.tmp 2616 5237.tmp 4980 5285.tmp 1016 52E3.tmp 3140 5340.tmp 4816 539E.tmp 3484 53FC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3432 4464 2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe 82 PID 4464 wrote to memory of 3432 4464 2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe 82 PID 4464 wrote to memory of 3432 4464 2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe 82 PID 3432 wrote to memory of 1320 3432 3CDA.tmp 84 PID 3432 wrote to memory of 1320 3432 3CDA.tmp 84 PID 3432 wrote to memory of 1320 3432 3CDA.tmp 84 PID 1320 wrote to memory of 2300 1320 3D57.tmp 85 PID 1320 wrote to memory of 2300 1320 3D57.tmp 85 PID 1320 wrote to memory of 2300 1320 3D57.tmp 85 PID 2300 wrote to memory of 540 2300 3DC4.tmp 86 PID 2300 wrote to memory of 540 2300 3DC4.tmp 86 PID 2300 wrote to memory of 540 2300 3DC4.tmp 86 PID 540 wrote to memory of 2796 540 3E32.tmp 88 PID 540 wrote to memory of 2796 540 3E32.tmp 88 PID 540 wrote to memory of 2796 540 3E32.tmp 88 PID 2796 wrote to memory of 2188 2796 3E80.tmp 89 PID 2796 wrote to memory of 2188 2796 3E80.tmp 89 PID 2796 wrote to memory of 2188 2796 3E80.tmp 89 PID 2188 wrote to memory of 4836 2188 3ECE.tmp 90 PID 2188 wrote to memory of 4836 2188 3ECE.tmp 90 PID 2188 wrote to memory of 4836 2188 3ECE.tmp 90 PID 4836 wrote to memory of 2616 4836 3F1C.tmp 91 PID 4836 wrote to memory of 2616 4836 3F1C.tmp 91 PID 4836 wrote to memory of 2616 4836 3F1C.tmp 91 PID 2616 wrote to memory of 5004 2616 3F6A.tmp 92 PID 2616 wrote to memory of 5004 2616 3F6A.tmp 92 PID 2616 wrote to memory of 5004 2616 3F6A.tmp 92 PID 5004 wrote to memory of 1972 5004 3FB8.tmp 93 PID 5004 wrote to memory of 1972 5004 3FB8.tmp 93 PID 5004 wrote to memory of 1972 5004 3FB8.tmp 93 PID 1972 wrote to memory of 3888 1972 4006.tmp 94 PID 1972 wrote to memory of 3888 1972 4006.tmp 94 PID 1972 wrote to memory of 3888 1972 4006.tmp 94 PID 3888 wrote to memory of 3484 3888 4055.tmp 95 PID 3888 wrote to memory of 3484 3888 4055.tmp 95 PID 3888 wrote to memory of 3484 3888 4055.tmp 95 PID 3484 wrote to memory of 3668 3484 40B2.tmp 96 PID 3484 wrote to memory of 3668 3484 40B2.tmp 96 PID 3484 wrote to memory of 3668 3484 40B2.tmp 96 PID 3668 wrote to memory of 2580 3668 4100.tmp 97 PID 3668 wrote to memory of 2580 3668 4100.tmp 97 PID 3668 wrote to memory of 2580 3668 4100.tmp 97 PID 2580 wrote to memory of 4564 2580 415E.tmp 98 PID 2580 wrote to memory of 4564 2580 415E.tmp 98 PID 2580 wrote to memory of 4564 2580 415E.tmp 98 PID 4564 wrote to memory of 2252 4564 41BC.tmp 99 PID 4564 wrote to memory of 2252 4564 41BC.tmp 99 PID 4564 wrote to memory of 2252 4564 41BC.tmp 99 PID 2252 wrote to memory of 3096 2252 421A.tmp 100 PID 2252 wrote to memory of 3096 2252 421A.tmp 100 PID 2252 wrote to memory of 3096 2252 421A.tmp 100 PID 3096 wrote to memory of 1988 3096 4277.tmp 101 PID 3096 wrote to memory of 1988 3096 4277.tmp 101 PID 3096 wrote to memory of 1988 3096 4277.tmp 101 PID 1988 wrote to memory of 2204 1988 42C6.tmp 102 PID 1988 wrote to memory of 2204 1988 42C6.tmp 102 PID 1988 wrote to memory of 2204 1988 42C6.tmp 102 PID 2204 wrote to memory of 100 2204 4323.tmp 103 PID 2204 wrote to memory of 100 2204 4323.tmp 103 PID 2204 wrote to memory of 100 2204 4323.tmp 103 PID 100 wrote to memory of 3736 100 4381.tmp 104 PID 100 wrote to memory of 3736 100 4381.tmp 104 PID 100 wrote to memory of 3736 100 4381.tmp 104 PID 3736 wrote to memory of 4208 3736 43DF.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_5d8f84cf83718c6a004e1ba7b6d6d70b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"23⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"24⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"25⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"26⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"27⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"28⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"29⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"30⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"31⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"32⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"33⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"34⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"35⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"36⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"37⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"38⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"39⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"40⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"41⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"42⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"43⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"44⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"45⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"46⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"47⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"48⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"49⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"50⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"51⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"52⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"53⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"54⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"55⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"56⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"57⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"58⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"59⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"60⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"61⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"62⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"63⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"64⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"65⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"66⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"67⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"68⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"69⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"70⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"72⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"73⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"74⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"75⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"76⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"77⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"78⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"79⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"80⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"81⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"82⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"83⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"84⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"85⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"86⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"87⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"88⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"89⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"90⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"91⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"92⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"94⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"95⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"96⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"97⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"98⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"99⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"100⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"101⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"102⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"103⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"104⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"105⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"106⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"107⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"108⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"109⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"110⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"111⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"112⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"113⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"114⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"115⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"116⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"117⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"118⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"119⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"120⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"121⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-