Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe
-
Size
487KB
-
MD5
50c5c8d6492e17a6f7faf04b7037d7bc
-
SHA1
f99e846fe8018df2a48a5c730cb2704a1bfd12c4
-
SHA256
bac6124f3d088e1de74304da0d28d416a1b57d42ff0487364999956bc1fea42c
-
SHA512
b75b756d63367c35e37ce5539e95a9c77b5c0f49dcc3978bf0d204aceb02dcfc332a93c2f2200c3e0c5c69c5caa3839874bcc4c180b1e72e23859423e5fd8c07
-
SSDEEP
12288:yU5rCOTeiN0rWL21lCnkJVKy5OTa+5DJbZ:yUQOJNlL21l6kTVaFJb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4672 3038.tmp 5028 30A5.tmp 4172 3103.tmp 3844 3180.tmp 5068 320C.tmp 4456 327A.tmp 4700 32E7.tmp 3728 3374.tmp 3128 33C2.tmp 4228 342F.tmp 4176 349D.tmp 884 351A.tmp 216 3587.tmp 2076 3604.tmp 4288 3652.tmp 1444 36A0.tmp 3256 371D.tmp 4244 378B.tmp 1732 37E8.tmp 2512 3836.tmp 3088 38A4.tmp 4556 3911.tmp 4940 397F.tmp 3944 39CD.tmp 3696 3A1B.tmp 2412 3A79.tmp 4508 3AD6.tmp 668 3B44.tmp 4512 3BA1.tmp 2108 3BF0.tmp 868 3C5D.tmp 3260 3CCA.tmp 1188 3D38.tmp 2864 3D86.tmp 2376 3DD4.tmp 2684 3E22.tmp 3132 3E70.tmp 3596 3EFD.tmp 1968 3F5B.tmp 4248 3FA9.tmp 772 3FF7.tmp 1764 4045.tmp 3208 4093.tmp 3032 40F1.tmp 3360 414F.tmp 4900 419D.tmp 1860 41EB.tmp 3736 4239.tmp 5012 4297.tmp 4440 42F4.tmp 4204 4343.tmp 1152 43A0.tmp 1272 43EE.tmp 4392 444C.tmp 3460 449A.tmp 1176 44E8.tmp 1168 4537.tmp 1840 4585.tmp 1420 45D3.tmp 5028 4631.tmp 3512 467F.tmp 1788 46CD.tmp 3844 471B.tmp 5068 4769.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 4672 2892 2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe 82 PID 2892 wrote to memory of 4672 2892 2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe 82 PID 2892 wrote to memory of 4672 2892 2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe 82 PID 4672 wrote to memory of 5028 4672 3038.tmp 84 PID 4672 wrote to memory of 5028 4672 3038.tmp 84 PID 4672 wrote to memory of 5028 4672 3038.tmp 84 PID 5028 wrote to memory of 4172 5028 30A5.tmp 85 PID 5028 wrote to memory of 4172 5028 30A5.tmp 85 PID 5028 wrote to memory of 4172 5028 30A5.tmp 85 PID 4172 wrote to memory of 3844 4172 3103.tmp 86 PID 4172 wrote to memory of 3844 4172 3103.tmp 86 PID 4172 wrote to memory of 3844 4172 3103.tmp 86 PID 3844 wrote to memory of 5068 3844 3180.tmp 87 PID 3844 wrote to memory of 5068 3844 3180.tmp 87 PID 3844 wrote to memory of 5068 3844 3180.tmp 87 PID 5068 wrote to memory of 4456 5068 320C.tmp 88 PID 5068 wrote to memory of 4456 5068 320C.tmp 88 PID 5068 wrote to memory of 4456 5068 320C.tmp 88 PID 4456 wrote to memory of 4700 4456 327A.tmp 89 PID 4456 wrote to memory of 4700 4456 327A.tmp 89 PID 4456 wrote to memory of 4700 4456 327A.tmp 89 PID 4700 wrote to memory of 3728 4700 32E7.tmp 90 PID 4700 wrote to memory of 3728 4700 32E7.tmp 90 PID 4700 wrote to memory of 3728 4700 32E7.tmp 90 PID 3728 wrote to memory of 3128 3728 3374.tmp 91 PID 3728 wrote to memory of 3128 3728 3374.tmp 91 PID 3728 wrote to memory of 3128 3728 3374.tmp 91 PID 3128 wrote to memory of 4228 3128 33C2.tmp 92 PID 3128 wrote to memory of 4228 3128 33C2.tmp 92 PID 3128 wrote to memory of 4228 3128 33C2.tmp 92 PID 4228 wrote to memory of 4176 4228 342F.tmp 93 PID 4228 wrote to memory of 4176 4228 342F.tmp 93 PID 4228 wrote to memory of 4176 4228 342F.tmp 93 PID 4176 wrote to memory of 884 4176 349D.tmp 94 PID 4176 wrote to memory of 884 4176 349D.tmp 94 PID 4176 wrote to memory of 884 4176 349D.tmp 94 PID 884 wrote to memory of 216 884 351A.tmp 95 PID 884 wrote to memory of 216 884 351A.tmp 95 PID 884 wrote to memory of 216 884 351A.tmp 95 PID 216 wrote to memory of 2076 216 3587.tmp 96 PID 216 wrote to memory of 2076 216 3587.tmp 96 PID 216 wrote to memory of 2076 216 3587.tmp 96 PID 2076 wrote to memory of 4288 2076 3604.tmp 97 PID 2076 wrote to memory of 4288 2076 3604.tmp 97 PID 2076 wrote to memory of 4288 2076 3604.tmp 97 PID 4288 wrote to memory of 1444 4288 3652.tmp 98 PID 4288 wrote to memory of 1444 4288 3652.tmp 98 PID 4288 wrote to memory of 1444 4288 3652.tmp 98 PID 1444 wrote to memory of 3256 1444 36A0.tmp 99 PID 1444 wrote to memory of 3256 1444 36A0.tmp 99 PID 1444 wrote to memory of 3256 1444 36A0.tmp 99 PID 3256 wrote to memory of 4244 3256 371D.tmp 100 PID 3256 wrote to memory of 4244 3256 371D.tmp 100 PID 3256 wrote to memory of 4244 3256 371D.tmp 100 PID 4244 wrote to memory of 1732 4244 378B.tmp 101 PID 4244 wrote to memory of 1732 4244 378B.tmp 101 PID 4244 wrote to memory of 1732 4244 378B.tmp 101 PID 1732 wrote to memory of 2512 1732 37E8.tmp 102 PID 1732 wrote to memory of 2512 1732 37E8.tmp 102 PID 1732 wrote to memory of 2512 1732 37E8.tmp 102 PID 2512 wrote to memory of 3088 2512 3836.tmp 103 PID 2512 wrote to memory of 3088 2512 3836.tmp 103 PID 2512 wrote to memory of 3088 2512 3836.tmp 103 PID 3088 wrote to memory of 4556 3088 38A4.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_50c5c8d6492e17a6f7faf04b7037d7bc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\30A5.tmp"C:\Users\Admin\AppData\Local\Temp\30A5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3103.tmp"C:\Users\Admin\AppData\Local\Temp\3103.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3180.tmp"C:\Users\Admin\AppData\Local\Temp\3180.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\3374.tmp"C:\Users\Admin\AppData\Local\Temp\3374.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\351A.tmp"C:\Users\Admin\AppData\Local\Temp\351A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"23⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"24⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"25⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"26⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"27⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"28⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"29⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"30⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"31⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"32⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"33⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"34⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"35⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"36⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"37⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"38⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"39⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"40⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"41⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"42⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"43⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"44⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"45⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"46⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"47⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"48⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"49⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"50⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"51⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"52⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"53⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"54⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"55⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"56⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"57⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"58⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"59⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"60⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"61⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"62⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"63⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"64⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"65⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"66⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"67⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"68⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"69⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"70⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"71⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"72⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"73⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"74⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"75⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"76⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"77⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"78⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"79⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"80⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"81⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"82⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"83⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"84⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"85⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"86⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"87⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"88⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"89⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"90⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"91⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"92⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"93⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"94⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"95⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"96⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"98⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"99⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"100⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"101⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"102⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"103⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"104⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"105⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"106⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"107⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"108⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"109⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"110⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"111⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"112⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"113⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"114⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"115⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"116⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"117⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"118⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"119⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"120⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"121⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-