Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 07:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
-
Size
520KB
-
MD5
f72f5884b1b7cbc7d1ecccaa4069c2ad
-
SHA1
a02ebf22ca87fd0cf4c2c781c73d7891675b7c90
-
SHA256
3a913ca3e717f01231c524091df8aff734973f4644a9213d50c87d19987e519d
-
SHA512
0fe8f518fca6fb9f562cab941d9df54850d6f175ac97152b8dc4c54658de62350b16810283db39393dbd792fa0e920c4dcf30392a2825ed4f83cffa5977faaa4
-
SSDEEP
12288:roRXOQjmOyEB0hMFO1ceh8Mk/i4SmkmblNxrtKNZ:rogQ9y1huO1mMk/NSspNxrtKN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 42A6.tmp 4964 4333.tmp 3464 43B0.tmp 4688 444C.tmp 1984 44E8.tmp 3104 4546.tmp 3772 45C3.tmp 4760 4611.tmp 3752 466F.tmp 4940 46CD.tmp 3372 471B.tmp 840 4788.tmp 4664 47E6.tmp 4936 4863.tmp 2768 48E0.tmp 4968 494D.tmp 4652 49CA.tmp 4676 4A38.tmp 4472 4AB5.tmp 3992 4B13.tmp 2172 4B90.tmp 1200 4BFD.tmp 1560 4C7A.tmp 4668 4CF7.tmp 2828 4D55.tmp 4328 4DD2.tmp 676 4E3F.tmp 2100 4EBC.tmp 876 4F49.tmp 1492 4FA6.tmp 3960 5014.tmp 1636 5081.tmp 2596 50DF.tmp 2256 512D.tmp 3708 518B.tmp 2036 51D9.tmp 2492 5227.tmp 2580 5275.tmp 4684 52D3.tmp 2456 5321.tmp 4816 536F.tmp 1788 53BD.tmp 4736 541B.tmp 3352 5469.tmp 1820 54B7.tmp 4868 5505.tmp 3144 5563.tmp 4728 55B1.tmp 4348 55FF.tmp 216 565D.tmp 1320 56AB.tmp 2840 56F9.tmp 224 5748.tmp 324 57A5.tmp 3456 5842.tmp 4016 5890.tmp 4828 58ED.tmp 1828 593C.tmp 628 5999.tmp 388 59E7.tmp 3680 5A45.tmp 2304 5A93.tmp 3744 5AE1.tmp 1900 5B30.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2668 1812 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 82 PID 1812 wrote to memory of 2668 1812 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 82 PID 1812 wrote to memory of 2668 1812 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 82 PID 2668 wrote to memory of 4964 2668 42A6.tmp 84 PID 2668 wrote to memory of 4964 2668 42A6.tmp 84 PID 2668 wrote to memory of 4964 2668 42A6.tmp 84 PID 4964 wrote to memory of 3464 4964 4333.tmp 85 PID 4964 wrote to memory of 3464 4964 4333.tmp 85 PID 4964 wrote to memory of 3464 4964 4333.tmp 85 PID 3464 wrote to memory of 4688 3464 43B0.tmp 87 PID 3464 wrote to memory of 4688 3464 43B0.tmp 87 PID 3464 wrote to memory of 4688 3464 43B0.tmp 87 PID 4688 wrote to memory of 1984 4688 444C.tmp 88 PID 4688 wrote to memory of 1984 4688 444C.tmp 88 PID 4688 wrote to memory of 1984 4688 444C.tmp 88 PID 1984 wrote to memory of 3104 1984 44E8.tmp 89 PID 1984 wrote to memory of 3104 1984 44E8.tmp 89 PID 1984 wrote to memory of 3104 1984 44E8.tmp 89 PID 3104 wrote to memory of 3772 3104 4546.tmp 90 PID 3104 wrote to memory of 3772 3104 4546.tmp 90 PID 3104 wrote to memory of 3772 3104 4546.tmp 90 PID 3772 wrote to memory of 4760 3772 45C3.tmp 91 PID 3772 wrote to memory of 4760 3772 45C3.tmp 91 PID 3772 wrote to memory of 4760 3772 45C3.tmp 91 PID 4760 wrote to memory of 3752 4760 4611.tmp 92 PID 4760 wrote to memory of 3752 4760 4611.tmp 92 PID 4760 wrote to memory of 3752 4760 4611.tmp 92 PID 3752 wrote to memory of 4940 3752 466F.tmp 93 PID 3752 wrote to memory of 4940 3752 466F.tmp 93 PID 3752 wrote to memory of 4940 3752 466F.tmp 93 PID 4940 wrote to memory of 3372 4940 46CD.tmp 94 PID 4940 wrote to memory of 3372 4940 46CD.tmp 94 PID 4940 wrote to memory of 3372 4940 46CD.tmp 94 PID 3372 wrote to memory of 840 3372 471B.tmp 95 PID 3372 wrote to memory of 840 3372 471B.tmp 95 PID 3372 wrote to memory of 840 3372 471B.tmp 95 PID 840 wrote to memory of 4664 840 4788.tmp 96 PID 840 wrote to memory of 4664 840 4788.tmp 96 PID 840 wrote to memory of 4664 840 4788.tmp 96 PID 4664 wrote to memory of 4936 4664 47E6.tmp 97 PID 4664 wrote to memory of 4936 4664 47E6.tmp 97 PID 4664 wrote to memory of 4936 4664 47E6.tmp 97 PID 4936 wrote to memory of 2768 4936 4863.tmp 98 PID 4936 wrote to memory of 2768 4936 4863.tmp 98 PID 4936 wrote to memory of 2768 4936 4863.tmp 98 PID 2768 wrote to memory of 4968 2768 48E0.tmp 99 PID 2768 wrote to memory of 4968 2768 48E0.tmp 99 PID 2768 wrote to memory of 4968 2768 48E0.tmp 99 PID 4968 wrote to memory of 4652 4968 494D.tmp 100 PID 4968 wrote to memory of 4652 4968 494D.tmp 100 PID 4968 wrote to memory of 4652 4968 494D.tmp 100 PID 4652 wrote to memory of 4676 4652 49CA.tmp 101 PID 4652 wrote to memory of 4676 4652 49CA.tmp 101 PID 4652 wrote to memory of 4676 4652 49CA.tmp 101 PID 4676 wrote to memory of 4472 4676 4A38.tmp 102 PID 4676 wrote to memory of 4472 4676 4A38.tmp 102 PID 4676 wrote to memory of 4472 4676 4A38.tmp 102 PID 4472 wrote to memory of 3992 4472 4AB5.tmp 103 PID 4472 wrote to memory of 3992 4472 4AB5.tmp 103 PID 4472 wrote to memory of 3992 4472 4AB5.tmp 103 PID 3992 wrote to memory of 2172 3992 4B13.tmp 104 PID 3992 wrote to memory of 2172 3992 4B13.tmp 104 PID 3992 wrote to memory of 2172 3992 4B13.tmp 104 PID 2172 wrote to memory of 1200 2172 4B90.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"23⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"24⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"25⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"26⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"27⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"28⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"29⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"30⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"31⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"32⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"33⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"34⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"35⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"36⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"37⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"38⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"39⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"40⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"41⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"42⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"43⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"44⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"45⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"46⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"47⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"48⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"49⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"50⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"51⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"52⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"53⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"54⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"55⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"56⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"57⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"58⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"59⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"60⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"61⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"62⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"63⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"64⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"65⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"66⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"67⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"68⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"69⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"70⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"71⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"72⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"73⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"75⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"76⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"77⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"78⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"79⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"80⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"81⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"82⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"83⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"84⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"85⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"86⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"87⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"88⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"89⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"90⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"91⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"92⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"93⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"94⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"95⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"96⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"97⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"98⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"99⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"100⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"101⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"102⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"103⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"104⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"105⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"106⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"107⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"108⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"109⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"110⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"111⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"112⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"113⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"114⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"115⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"116⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"117⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"118⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"119⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"120⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"121⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"122⤵PID:4700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-