Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe
-
Size
529KB
-
MD5
f0a4b3851202d355a60d4c4ece6fc078
-
SHA1
519156c1fa796616c91e881d8588ea8f9868bbb2
-
SHA256
91034fb23bf461b52ad381b7588d6618820c8c9bf597b2cc13dc8e227e5befc3
-
SHA512
b740d5d735a488eb185d4a3cbc47ff09d80f8a11538b888b35ea9faefa2cd4ea8ae3400e498ab3c8c22b27b95967f556799717ac89005cb38e616298448b52f7
-
SSDEEP
12288:NU5rCOTeijKPdGmqsTinyU0uGmWT7NyZUxzTZwlH4Hp:NUQOJjKRknyZuGR5FTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1704 3E70.tmp 3980 3F0C.tmp 2064 3F6A.tmp 2688 3FD8.tmp 808 4045.tmp 692 40C2.tmp 4992 4110.tmp 4408 418D.tmp 3140 41DB.tmp 2200 4239.tmp 1416 42C6.tmp 3076 4314.tmp 4668 4391.tmp 3016 43EE.tmp 3960 445C.tmp 2984 44D9.tmp 4600 4527.tmp 1512 4575.tmp 4964 45C3.tmp 3976 4611.tmp 3328 467F.tmp 3900 46DC.tmp 4608 4759.tmp 1240 47C7.tmp 1672 4844.tmp 2020 48C1.tmp 4596 490F.tmp 3228 498C.tmp 4472 49EA.tmp 2516 4A57.tmp 4948 4AB5.tmp 2788 4B03.tmp 4116 4B70.tmp 2416 4BBE.tmp 3324 4C0D.tmp 2632 4C5B.tmp 3440 4CA9.tmp 2696 4D07.tmp 4068 4D55.tmp 3000 4DB2.tmp 4624 4E01.tmp 1156 4E4F.tmp 3096 4EAC.tmp 2528 4F0A.tmp 384 4F58.tmp 1428 4FA6.tmp 4300 5004.tmp 1832 50A0.tmp 944 50EF.tmp 3052 514C.tmp 3980 51AA.tmp 4584 5217.tmp 1480 5266.tmp 1840 52B4.tmp 3460 5311.tmp 652 5360.tmp 2688 53AE.tmp 3028 540B.tmp 3916 545A.tmp 692 54B7.tmp 4992 5505.tmp 4932 5554.tmp 3804 55A2.tmp 744 55F0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 1704 4416 2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe 82 PID 4416 wrote to memory of 1704 4416 2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe 82 PID 4416 wrote to memory of 1704 4416 2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe 82 PID 1704 wrote to memory of 3980 1704 3E70.tmp 84 PID 1704 wrote to memory of 3980 1704 3E70.tmp 84 PID 1704 wrote to memory of 3980 1704 3E70.tmp 84 PID 3980 wrote to memory of 2064 3980 3F0C.tmp 85 PID 3980 wrote to memory of 2064 3980 3F0C.tmp 85 PID 3980 wrote to memory of 2064 3980 3F0C.tmp 85 PID 2064 wrote to memory of 2688 2064 3F6A.tmp 87 PID 2064 wrote to memory of 2688 2064 3F6A.tmp 87 PID 2064 wrote to memory of 2688 2064 3F6A.tmp 87 PID 2688 wrote to memory of 808 2688 3FD8.tmp 89 PID 2688 wrote to memory of 808 2688 3FD8.tmp 89 PID 2688 wrote to memory of 808 2688 3FD8.tmp 89 PID 808 wrote to memory of 692 808 4045.tmp 90 PID 808 wrote to memory of 692 808 4045.tmp 90 PID 808 wrote to memory of 692 808 4045.tmp 90 PID 692 wrote to memory of 4992 692 40C2.tmp 91 PID 692 wrote to memory of 4992 692 40C2.tmp 91 PID 692 wrote to memory of 4992 692 40C2.tmp 91 PID 4992 wrote to memory of 4408 4992 4110.tmp 92 PID 4992 wrote to memory of 4408 4992 4110.tmp 92 PID 4992 wrote to memory of 4408 4992 4110.tmp 92 PID 4408 wrote to memory of 3140 4408 418D.tmp 93 PID 4408 wrote to memory of 3140 4408 418D.tmp 93 PID 4408 wrote to memory of 3140 4408 418D.tmp 93 PID 3140 wrote to memory of 2200 3140 41DB.tmp 94 PID 3140 wrote to memory of 2200 3140 41DB.tmp 94 PID 3140 wrote to memory of 2200 3140 41DB.tmp 94 PID 2200 wrote to memory of 1416 2200 4239.tmp 95 PID 2200 wrote to memory of 1416 2200 4239.tmp 95 PID 2200 wrote to memory of 1416 2200 4239.tmp 95 PID 1416 wrote to memory of 3076 1416 42C6.tmp 96 PID 1416 wrote to memory of 3076 1416 42C6.tmp 96 PID 1416 wrote to memory of 3076 1416 42C6.tmp 96 PID 3076 wrote to memory of 4668 3076 4314.tmp 97 PID 3076 wrote to memory of 4668 3076 4314.tmp 97 PID 3076 wrote to memory of 4668 3076 4314.tmp 97 PID 4668 wrote to memory of 3016 4668 4391.tmp 98 PID 4668 wrote to memory of 3016 4668 4391.tmp 98 PID 4668 wrote to memory of 3016 4668 4391.tmp 98 PID 3016 wrote to memory of 3960 3016 43EE.tmp 99 PID 3016 wrote to memory of 3960 3016 43EE.tmp 99 PID 3016 wrote to memory of 3960 3016 43EE.tmp 99 PID 3960 wrote to memory of 2984 3960 445C.tmp 100 PID 3960 wrote to memory of 2984 3960 445C.tmp 100 PID 3960 wrote to memory of 2984 3960 445C.tmp 100 PID 2984 wrote to memory of 4600 2984 44D9.tmp 101 PID 2984 wrote to memory of 4600 2984 44D9.tmp 101 PID 2984 wrote to memory of 4600 2984 44D9.tmp 101 PID 4600 wrote to memory of 1512 4600 4527.tmp 102 PID 4600 wrote to memory of 1512 4600 4527.tmp 102 PID 4600 wrote to memory of 1512 4600 4527.tmp 102 PID 1512 wrote to memory of 4964 1512 4575.tmp 103 PID 1512 wrote to memory of 4964 1512 4575.tmp 103 PID 1512 wrote to memory of 4964 1512 4575.tmp 103 PID 4964 wrote to memory of 3976 4964 45C3.tmp 104 PID 4964 wrote to memory of 3976 4964 45C3.tmp 104 PID 4964 wrote to memory of 3976 4964 45C3.tmp 104 PID 3976 wrote to memory of 3328 3976 4611.tmp 105 PID 3976 wrote to memory of 3328 3976 4611.tmp 105 PID 3976 wrote to memory of 3328 3976 4611.tmp 105 PID 3328 wrote to memory of 3900 3328 467F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_f0a4b3851202d355a60d4c4ece6fc078_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"23⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"24⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"25⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"26⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"27⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"28⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"29⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"30⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"31⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"32⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"33⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"34⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"35⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"36⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"37⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"38⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"39⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"40⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"41⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"42⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"43⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"44⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"45⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"46⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"47⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"48⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"49⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"50⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"51⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"52⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"53⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"54⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"55⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"56⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"57⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"58⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"59⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"60⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"61⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"62⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"63⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"64⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"65⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"66⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"68⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"69⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"70⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"71⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"72⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"73⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"74⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"75⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"77⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"78⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"79⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"80⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"81⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"82⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"83⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"84⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"85⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"86⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"87⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"88⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"89⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"90⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"91⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"93⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"94⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"95⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"96⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"97⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"98⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"100⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"101⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"102⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"103⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"104⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"105⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"107⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"108⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"109⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"110⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"111⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"112⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"113⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"114⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"115⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"116⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"117⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"118⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"119⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"120⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"121⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"122⤵PID:1480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-