Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe
-
Size
536KB
-
MD5
5f6ec593770f4da86e3c8ef20fcb0243
-
SHA1
174aec42e12dcfb031d80fd80a02f8bacb5181d8
-
SHA256
649c049529ea5e8be37915dc811082237b049844ae69824ef0bee126e2cf5dff
-
SHA512
f7ed041824cc1af661668adc813f74be271ef08bfefdcc4a690abcb8a62ea522b426740dfaf0c5a4080a4c516afc5b5c20bf9a9015e6508ca353313d93f09e4e
-
SSDEEP
12288:wU5rCOTeiUEavxB8Ue2/B+gMBmyA1Y47HRQIZxVJ0ZT9:wUQOJUEu7e0BwD+HRQIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 F28E.tmp 1436 F31A.tmp 552 F3D6.tmp 1920 F472.tmp 3052 F4EF.tmp 4056 F58B.tmp 3504 F608.tmp 1692 F676.tmp 5088 F6E3.tmp 3172 F78F.tmp 4860 F81B.tmp 3236 F898.tmp 4836 F925.tmp 1336 F9D1.tmp 4964 FA4E.tmp 1964 FAEA.tmp 3432 FB86.tmp 4032 FC32.tmp 1716 FCAF.tmp 2684 FD7A.tmp 1780 FE36.tmp 4236 FEF1.tmp 4768 FF9D.tmp 5016 1A.tmp 3428 88.tmp 1432 124.tmp 4700 1D0.tmp 1004 27C.tmp 2592 318.tmp 1492 3D3.tmp 4072 460.tmp 4860 4DD.tmp 1688 579.tmp 1572 5D7.tmp 872 635.tmp 648 683.tmp 4024 700.tmp 3116 74E.tmp 3576 7BB.tmp 2156 838.tmp 2036 8B5.tmp 5044 904.tmp 4292 952.tmp 3532 9AF.tmp 4716 A1D.tmp 2508 A6B.tmp 3056 AC9.tmp 708 B36.tmp 5032 BA3.tmp 2408 BF2.tmp 2360 C30.tmp 4888 C7E.tmp 5092 CCC.tmp 4900 D1A.tmp 3516 D69.tmp 3496 DB7.tmp 1760 E14.tmp 4784 E72.tmp 3024 EC0.tmp 924 F1E.tmp 3572 F6C.tmp 3732 FBA.tmp 3504 1008.tmp 4172 1057.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1668 2312 2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe 91 PID 2312 wrote to memory of 1668 2312 2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe 91 PID 2312 wrote to memory of 1668 2312 2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe 91 PID 1668 wrote to memory of 1436 1668 F28E.tmp 92 PID 1668 wrote to memory of 1436 1668 F28E.tmp 92 PID 1668 wrote to memory of 1436 1668 F28E.tmp 92 PID 1436 wrote to memory of 552 1436 F31A.tmp 94 PID 1436 wrote to memory of 552 1436 F31A.tmp 94 PID 1436 wrote to memory of 552 1436 F31A.tmp 94 PID 552 wrote to memory of 1920 552 F3D6.tmp 95 PID 552 wrote to memory of 1920 552 F3D6.tmp 95 PID 552 wrote to memory of 1920 552 F3D6.tmp 95 PID 1920 wrote to memory of 3052 1920 F472.tmp 97 PID 1920 wrote to memory of 3052 1920 F472.tmp 97 PID 1920 wrote to memory of 3052 1920 F472.tmp 97 PID 3052 wrote to memory of 4056 3052 F4EF.tmp 98 PID 3052 wrote to memory of 4056 3052 F4EF.tmp 98 PID 3052 wrote to memory of 4056 3052 F4EF.tmp 98 PID 4056 wrote to memory of 3504 4056 F58B.tmp 100 PID 4056 wrote to memory of 3504 4056 F58B.tmp 100 PID 4056 wrote to memory of 3504 4056 F58B.tmp 100 PID 3504 wrote to memory of 1692 3504 F608.tmp 101 PID 3504 wrote to memory of 1692 3504 F608.tmp 101 PID 3504 wrote to memory of 1692 3504 F608.tmp 101 PID 1692 wrote to memory of 5088 1692 F676.tmp 102 PID 1692 wrote to memory of 5088 1692 F676.tmp 102 PID 1692 wrote to memory of 5088 1692 F676.tmp 102 PID 5088 wrote to memory of 3172 5088 F6E3.tmp 103 PID 5088 wrote to memory of 3172 5088 F6E3.tmp 103 PID 5088 wrote to memory of 3172 5088 F6E3.tmp 103 PID 3172 wrote to memory of 4860 3172 F78F.tmp 104 PID 3172 wrote to memory of 4860 3172 F78F.tmp 104 PID 3172 wrote to memory of 4860 3172 F78F.tmp 104 PID 4860 wrote to memory of 3236 4860 F81B.tmp 105 PID 4860 wrote to memory of 3236 4860 F81B.tmp 105 PID 4860 wrote to memory of 3236 4860 F81B.tmp 105 PID 3236 wrote to memory of 4836 3236 F898.tmp 106 PID 3236 wrote to memory of 4836 3236 F898.tmp 106 PID 3236 wrote to memory of 4836 3236 F898.tmp 106 PID 4836 wrote to memory of 1336 4836 F925.tmp 107 PID 4836 wrote to memory of 1336 4836 F925.tmp 107 PID 4836 wrote to memory of 1336 4836 F925.tmp 107 PID 1336 wrote to memory of 4964 1336 F9D1.tmp 108 PID 1336 wrote to memory of 4964 1336 F9D1.tmp 108 PID 1336 wrote to memory of 4964 1336 F9D1.tmp 108 PID 4964 wrote to memory of 1964 4964 FA4E.tmp 109 PID 4964 wrote to memory of 1964 4964 FA4E.tmp 109 PID 4964 wrote to memory of 1964 4964 FA4E.tmp 109 PID 1964 wrote to memory of 3432 1964 FAEA.tmp 110 PID 1964 wrote to memory of 3432 1964 FAEA.tmp 110 PID 1964 wrote to memory of 3432 1964 FAEA.tmp 110 PID 3432 wrote to memory of 4032 3432 FB86.tmp 111 PID 3432 wrote to memory of 4032 3432 FB86.tmp 111 PID 3432 wrote to memory of 4032 3432 FB86.tmp 111 PID 4032 wrote to memory of 1716 4032 FC32.tmp 112 PID 4032 wrote to memory of 1716 4032 FC32.tmp 112 PID 4032 wrote to memory of 1716 4032 FC32.tmp 112 PID 1716 wrote to memory of 2684 1716 FCAF.tmp 114 PID 1716 wrote to memory of 2684 1716 FCAF.tmp 114 PID 1716 wrote to memory of 2684 1716 FCAF.tmp 114 PID 2684 wrote to memory of 1780 2684 FD7A.tmp 115 PID 2684 wrote to memory of 1780 2684 FD7A.tmp 115 PID 2684 wrote to memory of 1780 2684 FD7A.tmp 115 PID 1780 wrote to memory of 4236 1780 FE36.tmp 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_5f6ec593770f4da86e3c8ef20fcb0243_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"23⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"24⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"25⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"26⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"27⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"28⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"29⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"30⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"31⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"32⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"33⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"34⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"35⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"36⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"37⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"38⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"39⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"40⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"41⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"42⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"43⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"44⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"45⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"46⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"47⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"48⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"49⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"50⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"51⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"52⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"53⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"54⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"55⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"56⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"57⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"58⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"59⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"60⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"61⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"62⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"63⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"64⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"65⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"66⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"67⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"68⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"69⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"70⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"71⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"72⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"73⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"74⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"75⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"76⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"77⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"78⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"79⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"80⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"81⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"82⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"83⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"84⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"85⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"86⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"87⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"88⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"89⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"90⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"91⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"92⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"94⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"95⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"96⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"97⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"98⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"99⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"100⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"101⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"102⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"103⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"104⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"105⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"106⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"107⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"108⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"109⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"110⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"111⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"112⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"113⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"114⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"115⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"116⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"118⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"119⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"120⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"121⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"122⤵PID:3280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-