Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 07:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe
-
Size
530KB
-
MD5
bc23c9f6374532a367bc2c2c8293eb78
-
SHA1
ace2416c51d71594f919fba1510dde6a60b828b7
-
SHA256
2b27fbf88c162f855665ebbfe81a08ce714d52a039df6f612ab0986c2f25a519
-
SHA512
9fbc329357e89ebc98349c26ff96d74b547c4d651bde703fe79a82d1c19a2b09f55f234ecf9ffa482c0ef16dc42b8df23b8189a2a597c3dee70bf5b0fc0e5492
-
SSDEEP
12288:AU5rCOTeioWjYMTnddEDhXyO3p4oJ4h5VdNZulFVg0M1:AUQOJoQVZYhfp4Ph5LNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5100 3539.tmp 904 35B6.tmp 2284 3614.tmp 4596 3681.tmp 3160 36EE.tmp 4520 373C.tmp 3964 378B.tmp 3036 37E8.tmp 5116 3846.tmp 400 38B3.tmp 4356 3902.tmp 1960 396F.tmp 3100 39BD.tmp 3332 3A1B.tmp 2376 3A98.tmp 2612 3B05.tmp 4004 3B63.tmp 2180 3BC1.tmp 3856 3C1E.tmp 2552 3C7C.tmp 2656 3CEA.tmp 868 3D67.tmp 4212 3DE4.tmp 3032 3E51.tmp 4184 3EAF.tmp 464 3F2C.tmp 3608 3FB8.tmp 684 4016.tmp 4932 4083.tmp 872 40D2.tmp 4276 4120.tmp 1244 418D.tmp 3212 41FA.tmp 1524 4258.tmp 4304 42A6.tmp 3952 42F4.tmp 1632 4343.tmp 2224 4391.tmp 4716 440E.tmp 5060 446B.tmp 4860 44C9.tmp 3424 4517.tmp 4436 4575.tmp 1296 45C3.tmp 784 4621.tmp 3036 466F.tmp 4984 46CD.tmp 3512 471B.tmp 5036 4769.tmp 4356 47C7.tmp 1916 4825.tmp 5072 4882.tmp 2908 48E0.tmp 4892 492E.tmp 1844 498C.tmp 2360 49EA.tmp 1896 4A38.tmp 3828 4A86.tmp 4584 4AD4.tmp 1068 4B22.tmp 3496 4B70.tmp 1276 4BCE.tmp 5028 4C1C.tmp 2128 4C7A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 5100 5004 2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe 82 PID 5004 wrote to memory of 5100 5004 2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe 82 PID 5004 wrote to memory of 5100 5004 2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe 82 PID 5100 wrote to memory of 904 5100 3539.tmp 83 PID 5100 wrote to memory of 904 5100 3539.tmp 83 PID 5100 wrote to memory of 904 5100 3539.tmp 83 PID 904 wrote to memory of 2284 904 35B6.tmp 84 PID 904 wrote to memory of 2284 904 35B6.tmp 84 PID 904 wrote to memory of 2284 904 35B6.tmp 84 PID 2284 wrote to memory of 4596 2284 3614.tmp 85 PID 2284 wrote to memory of 4596 2284 3614.tmp 85 PID 2284 wrote to memory of 4596 2284 3614.tmp 85 PID 4596 wrote to memory of 3160 4596 3681.tmp 87 PID 4596 wrote to memory of 3160 4596 3681.tmp 87 PID 4596 wrote to memory of 3160 4596 3681.tmp 87 PID 3160 wrote to memory of 4520 3160 36EE.tmp 89 PID 3160 wrote to memory of 4520 3160 36EE.tmp 89 PID 3160 wrote to memory of 4520 3160 36EE.tmp 89 PID 4520 wrote to memory of 3964 4520 373C.tmp 91 PID 4520 wrote to memory of 3964 4520 373C.tmp 91 PID 4520 wrote to memory of 3964 4520 373C.tmp 91 PID 3964 wrote to memory of 3036 3964 378B.tmp 92 PID 3964 wrote to memory of 3036 3964 378B.tmp 92 PID 3964 wrote to memory of 3036 3964 378B.tmp 92 PID 3036 wrote to memory of 5116 3036 37E8.tmp 93 PID 3036 wrote to memory of 5116 3036 37E8.tmp 93 PID 3036 wrote to memory of 5116 3036 37E8.tmp 93 PID 5116 wrote to memory of 400 5116 3846.tmp 94 PID 5116 wrote to memory of 400 5116 3846.tmp 94 PID 5116 wrote to memory of 400 5116 3846.tmp 94 PID 400 wrote to memory of 4356 400 38B3.tmp 95 PID 400 wrote to memory of 4356 400 38B3.tmp 95 PID 400 wrote to memory of 4356 400 38B3.tmp 95 PID 4356 wrote to memory of 1960 4356 3902.tmp 96 PID 4356 wrote to memory of 1960 4356 3902.tmp 96 PID 4356 wrote to memory of 1960 4356 3902.tmp 96 PID 1960 wrote to memory of 3100 1960 396F.tmp 97 PID 1960 wrote to memory of 3100 1960 396F.tmp 97 PID 1960 wrote to memory of 3100 1960 396F.tmp 97 PID 3100 wrote to memory of 3332 3100 39BD.tmp 98 PID 3100 wrote to memory of 3332 3100 39BD.tmp 98 PID 3100 wrote to memory of 3332 3100 39BD.tmp 98 PID 3332 wrote to memory of 2376 3332 3A1B.tmp 99 PID 3332 wrote to memory of 2376 3332 3A1B.tmp 99 PID 3332 wrote to memory of 2376 3332 3A1B.tmp 99 PID 2376 wrote to memory of 2612 2376 3A98.tmp 100 PID 2376 wrote to memory of 2612 2376 3A98.tmp 100 PID 2376 wrote to memory of 2612 2376 3A98.tmp 100 PID 2612 wrote to memory of 4004 2612 3B05.tmp 101 PID 2612 wrote to memory of 4004 2612 3B05.tmp 101 PID 2612 wrote to memory of 4004 2612 3B05.tmp 101 PID 4004 wrote to memory of 2180 4004 3B63.tmp 102 PID 4004 wrote to memory of 2180 4004 3B63.tmp 102 PID 4004 wrote to memory of 2180 4004 3B63.tmp 102 PID 2180 wrote to memory of 3856 2180 3BC1.tmp 103 PID 2180 wrote to memory of 3856 2180 3BC1.tmp 103 PID 2180 wrote to memory of 3856 2180 3BC1.tmp 103 PID 3856 wrote to memory of 2552 3856 3C1E.tmp 104 PID 3856 wrote to memory of 2552 3856 3C1E.tmp 104 PID 3856 wrote to memory of 2552 3856 3C1E.tmp 104 PID 2552 wrote to memory of 2656 2552 3C7C.tmp 105 PID 2552 wrote to memory of 2656 2552 3C7C.tmp 105 PID 2552 wrote to memory of 2656 2552 3C7C.tmp 105 PID 2656 wrote to memory of 868 2656 3CEA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_bc23c9f6374532a367bc2c2c8293eb78_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"C:\Users\Admin\AppData\Local\Temp\3CEA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"23⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"24⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"25⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"26⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"27⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"28⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"29⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"30⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"31⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"32⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"33⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"34⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"35⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"36⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"37⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"38⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"39⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"40⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"41⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"42⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"43⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"44⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"45⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"46⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"47⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"48⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"49⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"50⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"51⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"52⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"53⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"54⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"55⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"56⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"57⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"58⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"59⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"60⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"61⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"62⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"63⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"64⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"65⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"66⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"67⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"68⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"69⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"70⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"71⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"72⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"73⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"74⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"75⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"76⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"77⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"78⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"79⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"80⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"81⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"82⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"83⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"85⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"86⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"87⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"88⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"89⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"90⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"91⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"92⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"93⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"94⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"95⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"96⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"97⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"98⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"99⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"100⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"101⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"102⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"103⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"104⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"105⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"106⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"107⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"108⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"109⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"110⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"111⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"112⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"113⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"114⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"115⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"116⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"117⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"118⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"119⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"120⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"121⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-