Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe
-
Size
541KB
-
MD5
0322f8b5615592bda0e5bd5ce2fdd295
-
SHA1
1e0300e953846728ff06220b71858a3fab57a963
-
SHA256
23a410f2fa1f644acaa40e5f47420607161b686500a100260421aa204e4e2a73
-
SHA512
7d06cd509fa01d307941ba8a2e55dee39ccbf7d950c8719c4bc1f47d564d0676b7dcd440a391a776f7640b659313b4bf7dbd08a33dff637be458ad8ab239ad32
-
SSDEEP
12288:UU5rCOTeif/1leW0pbN0jOnvadNMprZa73ctO:UUQOJf/1mBN0jMACrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4584 179A.tmp 464 18D2.tmp 2112 198E.tmp 4776 1A69.tmp 452 1B63.tmp 704 1C1E.tmp 2220 1D28.tmp 116 1E22.tmp 1416 1EFD.tmp 3812 1FE7.tmp 3768 20B2.tmp 1612 215E.tmp 2352 220A.tmp 4904 2304.tmp 4332 23B0.tmp 4136 247B.tmp 2412 2556.tmp 3008 2621.tmp 4304 26CD.tmp 4632 2788.tmp 3108 2872.tmp 2956 293E.tmp 3804 29DA.tmp 3416 2AC4.tmp 3128 2B51.tmp 928 2C5A.tmp 2708 2D26.tmp 1548 2E00.tmp 4660 2E8D.tmp 1104 2F58.tmp 2732 3023.tmp 2720 30B0.tmp 3084 316B.tmp 2712 3256.tmp 2264 32D3.tmp 3452 3340.tmp 4208 33BD.tmp 4564 3479.tmp 3564 34D6.tmp 3264 3573.tmp 4992 35FF.tmp 1188 368C.tmp 464 3738.tmp 3104 3795.tmp 1896 3803.tmp 4308 388F.tmp 4156 38FD.tmp 4736 39A9.tmp 4224 3A26.tmp 3336 3AB2.tmp 4696 3B2F.tmp 1520 3B8D.tmp 1416 3C1A.tmp 1420 3C87.tmp 1160 3D04.tmp 2940 3D71.tmp 1708 3DEE.tmp 4044 3E5C.tmp 2412 3EC9.tmp 2420 3F56.tmp 4304 4002.tmp 4548 40AE.tmp 2176 414A.tmp 3292 41E6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3696 wrote to memory of 4584 3696 2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe 90 PID 3696 wrote to memory of 4584 3696 2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe 90 PID 3696 wrote to memory of 4584 3696 2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe 90 PID 4584 wrote to memory of 464 4584 179A.tmp 91 PID 4584 wrote to memory of 464 4584 179A.tmp 91 PID 4584 wrote to memory of 464 4584 179A.tmp 91 PID 464 wrote to memory of 2112 464 18D2.tmp 92 PID 464 wrote to memory of 2112 464 18D2.tmp 92 PID 464 wrote to memory of 2112 464 18D2.tmp 92 PID 2112 wrote to memory of 4776 2112 198E.tmp 93 PID 2112 wrote to memory of 4776 2112 198E.tmp 93 PID 2112 wrote to memory of 4776 2112 198E.tmp 93 PID 4776 wrote to memory of 452 4776 1A69.tmp 94 PID 4776 wrote to memory of 452 4776 1A69.tmp 94 PID 4776 wrote to memory of 452 4776 1A69.tmp 94 PID 452 wrote to memory of 704 452 1B63.tmp 95 PID 452 wrote to memory of 704 452 1B63.tmp 95 PID 452 wrote to memory of 704 452 1B63.tmp 95 PID 704 wrote to memory of 2220 704 1C1E.tmp 96 PID 704 wrote to memory of 2220 704 1C1E.tmp 96 PID 704 wrote to memory of 2220 704 1C1E.tmp 96 PID 2220 wrote to memory of 116 2220 1D28.tmp 97 PID 2220 wrote to memory of 116 2220 1D28.tmp 97 PID 2220 wrote to memory of 116 2220 1D28.tmp 97 PID 116 wrote to memory of 1416 116 1E22.tmp 98 PID 116 wrote to memory of 1416 116 1E22.tmp 98 PID 116 wrote to memory of 1416 116 1E22.tmp 98 PID 1416 wrote to memory of 3812 1416 1EFD.tmp 99 PID 1416 wrote to memory of 3812 1416 1EFD.tmp 99 PID 1416 wrote to memory of 3812 1416 1EFD.tmp 99 PID 3812 wrote to memory of 3768 3812 1FE7.tmp 100 PID 3812 wrote to memory of 3768 3812 1FE7.tmp 100 PID 3812 wrote to memory of 3768 3812 1FE7.tmp 100 PID 3768 wrote to memory of 1612 3768 20B2.tmp 101 PID 3768 wrote to memory of 1612 3768 20B2.tmp 101 PID 3768 wrote to memory of 1612 3768 20B2.tmp 101 PID 1612 wrote to memory of 2352 1612 215E.tmp 102 PID 1612 wrote to memory of 2352 1612 215E.tmp 102 PID 1612 wrote to memory of 2352 1612 215E.tmp 102 PID 2352 wrote to memory of 4904 2352 220A.tmp 103 PID 2352 wrote to memory of 4904 2352 220A.tmp 103 PID 2352 wrote to memory of 4904 2352 220A.tmp 103 PID 4904 wrote to memory of 4332 4904 2304.tmp 104 PID 4904 wrote to memory of 4332 4904 2304.tmp 104 PID 4904 wrote to memory of 4332 4904 2304.tmp 104 PID 4332 wrote to memory of 4136 4332 23B0.tmp 105 PID 4332 wrote to memory of 4136 4332 23B0.tmp 105 PID 4332 wrote to memory of 4136 4332 23B0.tmp 105 PID 4136 wrote to memory of 2412 4136 247B.tmp 106 PID 4136 wrote to memory of 2412 4136 247B.tmp 106 PID 4136 wrote to memory of 2412 4136 247B.tmp 106 PID 2412 wrote to memory of 3008 2412 2556.tmp 107 PID 2412 wrote to memory of 3008 2412 2556.tmp 107 PID 2412 wrote to memory of 3008 2412 2556.tmp 107 PID 3008 wrote to memory of 4304 3008 2621.tmp 108 PID 3008 wrote to memory of 4304 3008 2621.tmp 108 PID 3008 wrote to memory of 4304 3008 2621.tmp 108 PID 4304 wrote to memory of 4632 4304 26CD.tmp 109 PID 4304 wrote to memory of 4632 4304 26CD.tmp 109 PID 4304 wrote to memory of 4632 4304 26CD.tmp 109 PID 4632 wrote to memory of 3108 4632 2788.tmp 110 PID 4632 wrote to memory of 3108 4632 2788.tmp 110 PID 4632 wrote to memory of 3108 4632 2788.tmp 110 PID 3108 wrote to memory of 2956 3108 2872.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_0322f8b5615592bda0e5bd5ce2fdd295_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"23⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"24⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"25⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"26⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"27⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"28⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"29⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"30⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"31⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"32⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"33⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"34⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"35⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"36⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"37⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"38⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"39⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"40⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"41⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"42⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"43⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"44⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"45⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"46⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"47⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"48⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"49⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"50⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"51⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"52⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"53⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"54⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"55⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"56⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"57⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"58⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"59⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"60⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"61⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"62⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"63⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"64⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"65⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"67⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"68⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"69⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"70⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"71⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"72⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"73⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"74⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"75⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"76⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"77⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"78⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"79⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"80⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"81⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"82⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"83⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"84⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"85⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"86⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"87⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"88⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"89⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"90⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"91⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"92⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"93⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"94⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"95⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"96⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"97⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"98⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"99⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"100⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"101⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"103⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"104⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"105⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"106⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"107⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"108⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"109⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"110⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"111⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"112⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"113⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"114⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"115⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"116⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"117⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"118⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"119⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"120⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"121⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-