Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe
-
Size
487KB
-
MD5
e36508e40492aec6f299ca78ec743118
-
SHA1
1abd7e6e0d5948481942c79b6d3d6e12653cc926
-
SHA256
7d9d8f3d54ce595cb92f0583daebbdecab31fe1e61326bccd26c190100ce9ba3
-
SHA512
12c7ed5cf77d5b73ce6bad2494d51c45da80463813c0bc352f850d932a89d77224545df863c77a1af386336b9d46f9638f2b25ed8f87d5b0a9e17992e54f1f37
-
SSDEEP
12288:yU5rCOTeiNZhPB0LniIfjpJyN01EVYtpbZ:yUQOJNnPu7XbfyNMZb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4464 E8F8.tmp 3864 E995.tmp 4620 EA12.tmp 3044 EA9E.tmp 3668 EB3B.tmp 2880 EBE6.tmp 3396 ECB2.tmp 1000 ED2F.tmp 4064 EDBB.tmp 916 EE38.tmp 1164 EEA6.tmp 1644 EF32.tmp 3836 EFA0.tmp 2784 F00D.tmp 1280 F09A.tmp 4220 F145.tmp 3420 F1C2.tmp 748 F23F.tmp 3812 F2AD.tmp 4536 F31A.tmp 5088 F3B6.tmp 2320 F433.tmp 2560 F4C0.tmp 3080 F53D.tmp 5080 F5E9.tmp 2764 F656.tmp 3488 F6C4.tmp 3492 F731.tmp 2044 F79E.tmp 4336 F81B.tmp 1832 F889.tmp 3532 F906.tmp 1480 F9B2.tmp 3096 FA1F.tmp 2876 FA7D.tmp 4620 FACB.tmp 1296 FB38.tmp 1776 FBB5.tmp 2880 FC03.tmp 1000 FC52.tmp 916 FCA0.tmp 2256 FCEE.tmp 1644 FD4C.tmp 5008 FDA9.tmp 1404 FE07.tmp 3372 FE65.tmp 5108 FEC3.tmp 4184 FF30.tmp 3124 FF9D.tmp 4972 FFFB.tmp 4576 59.tmp 1980 C6.tmp 864 134.tmp 4536 191.tmp 2144 1FF.tmp 5104 25C.tmp 228 2CA.tmp 2560 337.tmp 3080 385.tmp 2216 3F3.tmp 884 460.tmp 2808 4DD.tmp 3756 54A.tmp 4556 5A8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 4464 1640 2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe 90 PID 1640 wrote to memory of 4464 1640 2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe 90 PID 1640 wrote to memory of 4464 1640 2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe 90 PID 4464 wrote to memory of 3864 4464 E8F8.tmp 91 PID 4464 wrote to memory of 3864 4464 E8F8.tmp 91 PID 4464 wrote to memory of 3864 4464 E8F8.tmp 91 PID 3864 wrote to memory of 4620 3864 E995.tmp 92 PID 3864 wrote to memory of 4620 3864 E995.tmp 92 PID 3864 wrote to memory of 4620 3864 E995.tmp 92 PID 4620 wrote to memory of 3044 4620 EA12.tmp 94 PID 4620 wrote to memory of 3044 4620 EA12.tmp 94 PID 4620 wrote to memory of 3044 4620 EA12.tmp 94 PID 3044 wrote to memory of 3668 3044 EA9E.tmp 96 PID 3044 wrote to memory of 3668 3044 EA9E.tmp 96 PID 3044 wrote to memory of 3668 3044 EA9E.tmp 96 PID 3668 wrote to memory of 2880 3668 EB3B.tmp 97 PID 3668 wrote to memory of 2880 3668 EB3B.tmp 97 PID 3668 wrote to memory of 2880 3668 EB3B.tmp 97 PID 2880 wrote to memory of 3396 2880 EBE6.tmp 98 PID 2880 wrote to memory of 3396 2880 EBE6.tmp 98 PID 2880 wrote to memory of 3396 2880 EBE6.tmp 98 PID 3396 wrote to memory of 1000 3396 ECB2.tmp 99 PID 3396 wrote to memory of 1000 3396 ECB2.tmp 99 PID 3396 wrote to memory of 1000 3396 ECB2.tmp 99 PID 1000 wrote to memory of 4064 1000 ED2F.tmp 100 PID 1000 wrote to memory of 4064 1000 ED2F.tmp 100 PID 1000 wrote to memory of 4064 1000 ED2F.tmp 100 PID 4064 wrote to memory of 916 4064 EDBB.tmp 101 PID 4064 wrote to memory of 916 4064 EDBB.tmp 101 PID 4064 wrote to memory of 916 4064 EDBB.tmp 101 PID 916 wrote to memory of 1164 916 EE38.tmp 102 PID 916 wrote to memory of 1164 916 EE38.tmp 102 PID 916 wrote to memory of 1164 916 EE38.tmp 102 PID 1164 wrote to memory of 1644 1164 EEA6.tmp 103 PID 1164 wrote to memory of 1644 1164 EEA6.tmp 103 PID 1164 wrote to memory of 1644 1164 EEA6.tmp 103 PID 1644 wrote to memory of 3836 1644 EF32.tmp 104 PID 1644 wrote to memory of 3836 1644 EF32.tmp 104 PID 1644 wrote to memory of 3836 1644 EF32.tmp 104 PID 3836 wrote to memory of 2784 3836 EFA0.tmp 105 PID 3836 wrote to memory of 2784 3836 EFA0.tmp 105 PID 3836 wrote to memory of 2784 3836 EFA0.tmp 105 PID 2784 wrote to memory of 1280 2784 F00D.tmp 106 PID 2784 wrote to memory of 1280 2784 F00D.tmp 106 PID 2784 wrote to memory of 1280 2784 F00D.tmp 106 PID 1280 wrote to memory of 4220 1280 F09A.tmp 107 PID 1280 wrote to memory of 4220 1280 F09A.tmp 107 PID 1280 wrote to memory of 4220 1280 F09A.tmp 107 PID 4220 wrote to memory of 3420 4220 F145.tmp 108 PID 4220 wrote to memory of 3420 4220 F145.tmp 108 PID 4220 wrote to memory of 3420 4220 F145.tmp 108 PID 3420 wrote to memory of 748 3420 F1C2.tmp 109 PID 3420 wrote to memory of 748 3420 F1C2.tmp 109 PID 3420 wrote to memory of 748 3420 F1C2.tmp 109 PID 748 wrote to memory of 3812 748 F23F.tmp 110 PID 748 wrote to memory of 3812 748 F23F.tmp 110 PID 748 wrote to memory of 3812 748 F23F.tmp 110 PID 3812 wrote to memory of 4536 3812 F2AD.tmp 111 PID 3812 wrote to memory of 4536 3812 F2AD.tmp 111 PID 3812 wrote to memory of 4536 3812 F2AD.tmp 111 PID 4536 wrote to memory of 5088 4536 F31A.tmp 112 PID 4536 wrote to memory of 5088 4536 F31A.tmp 112 PID 4536 wrote to memory of 5088 4536 F31A.tmp 112 PID 5088 wrote to memory of 2320 5088 F3B6.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_e36508e40492aec6f299ca78ec743118_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"23⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"24⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"25⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"27⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"28⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"29⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"30⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"31⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"32⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"33⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"34⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"35⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"36⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"37⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"38⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"39⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"40⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"41⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"42⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"43⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"44⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"45⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"46⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"47⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"48⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"49⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"50⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"51⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"52⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"53⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"54⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"55⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"56⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"57⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"58⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"59⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"60⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"61⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"62⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"63⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"64⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"65⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"66⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"67⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"68⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"69⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"70⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"71⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"72⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"73⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"74⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"75⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"76⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"77⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"79⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"80⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"81⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"82⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"83⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"84⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"85⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"86⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"87⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"88⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"89⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"90⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"91⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"92⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"93⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"94⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"95⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"97⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"98⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"99⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"100⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"101⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"102⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"103⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"104⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"105⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"106⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"107⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"108⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"109⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"110⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"111⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"112⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"113⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"114⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"115⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"116⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"117⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"118⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"119⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"120⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"121⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"122⤵PID:4324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-