Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe
-
Size
527KB
-
MD5
0fcb533ee73b6772bc9f19a39b4d0e37
-
SHA1
10353e442a768782efba8ca0d6f3921ebad4dac9
-
SHA256
c6200d4bce590f5234b303607af7a59aecf28c984bdcd2fd3c064d741432c1ac
-
SHA512
dce98b9af88c5c86210f752c78fb6bf0183ea86948e0c66d71a9b7a1ef3e692b6d071dee34470b66b4178d42ac4eac85b3d26c7b880b6d9fad41198755ba2737
-
SSDEEP
12288:fU5rCOTeidV4zc7dQuGxUAnqkmY1fVDZu:fUQOJdug7dQDZqwDDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 408 399E.tmp 2596 3A0B.tmp 1812 3A88.tmp 5112 3B15.tmp 2636 3B73.tmp 2692 3BE0.tmp 4424 3C6D.tmp 2012 3CBB.tmp 1716 3D38.tmp 4812 3DB5.tmp 4072 3E32.tmp 4416 3E9F.tmp 4336 3EED.tmp 216 3F4B.tmp 4952 3FA9.tmp 2132 4035.tmp 808 40B2.tmp 4828 412F.tmp 3968 418D.tmp 2892 420A.tmp 3232 4268.tmp 4552 42B6.tmp 540 4343.tmp 3680 4391.tmp 5080 440E.tmp 5104 445C.tmp 4824 44C9.tmp 3264 4546.tmp 2876 45B4.tmp 900 4640.tmp 4708 46BD.tmp 460 473A.tmp 4616 47A8.tmp 4432 4805.tmp 4320 4863.tmp 1544 48C1.tmp 2036 490F.tmp 4804 496D.tmp 3436 49CA.tmp 1044 4A28.tmp 3512 4A86.tmp 2376 4AE4.tmp 4172 4B32.tmp 4772 4B90.tmp 2068 4BDE.tmp 3760 4C2C.tmp 1220 4C8A.tmp 4880 4CD8.tmp 2980 4D26.tmp 1124 4D74.tmp 4912 4DC2.tmp 1964 4E20.tmp 1648 4E6E.tmp 4556 4EAC.tmp 2664 4EFB.tmp 2764 4F49.tmp 2568 4F97.tmp 3856 4FE5.tmp 2216 5033.tmp 3184 5081.tmp 4620 50CF.tmp 1284 511D.tmp 3428 516C.tmp 1844 51BA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 408 1328 2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe 81 PID 1328 wrote to memory of 408 1328 2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe 81 PID 1328 wrote to memory of 408 1328 2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe 81 PID 408 wrote to memory of 2596 408 399E.tmp 82 PID 408 wrote to memory of 2596 408 399E.tmp 82 PID 408 wrote to memory of 2596 408 399E.tmp 82 PID 2596 wrote to memory of 1812 2596 3A0B.tmp 83 PID 2596 wrote to memory of 1812 2596 3A0B.tmp 83 PID 2596 wrote to memory of 1812 2596 3A0B.tmp 83 PID 1812 wrote to memory of 5112 1812 3A88.tmp 84 PID 1812 wrote to memory of 5112 1812 3A88.tmp 84 PID 1812 wrote to memory of 5112 1812 3A88.tmp 84 PID 5112 wrote to memory of 2636 5112 3B15.tmp 85 PID 5112 wrote to memory of 2636 5112 3B15.tmp 85 PID 5112 wrote to memory of 2636 5112 3B15.tmp 85 PID 2636 wrote to memory of 2692 2636 3B73.tmp 86 PID 2636 wrote to memory of 2692 2636 3B73.tmp 86 PID 2636 wrote to memory of 2692 2636 3B73.tmp 86 PID 2692 wrote to memory of 4424 2692 3BE0.tmp 87 PID 2692 wrote to memory of 4424 2692 3BE0.tmp 87 PID 2692 wrote to memory of 4424 2692 3BE0.tmp 87 PID 4424 wrote to memory of 2012 4424 3C6D.tmp 88 PID 4424 wrote to memory of 2012 4424 3C6D.tmp 88 PID 4424 wrote to memory of 2012 4424 3C6D.tmp 88 PID 2012 wrote to memory of 1716 2012 3CBB.tmp 89 PID 2012 wrote to memory of 1716 2012 3CBB.tmp 89 PID 2012 wrote to memory of 1716 2012 3CBB.tmp 89 PID 1716 wrote to memory of 4812 1716 3D38.tmp 90 PID 1716 wrote to memory of 4812 1716 3D38.tmp 90 PID 1716 wrote to memory of 4812 1716 3D38.tmp 90 PID 4812 wrote to memory of 4072 4812 3DB5.tmp 91 PID 4812 wrote to memory of 4072 4812 3DB5.tmp 91 PID 4812 wrote to memory of 4072 4812 3DB5.tmp 91 PID 4072 wrote to memory of 4416 4072 3E32.tmp 92 PID 4072 wrote to memory of 4416 4072 3E32.tmp 92 PID 4072 wrote to memory of 4416 4072 3E32.tmp 92 PID 4416 wrote to memory of 4336 4416 3E9F.tmp 93 PID 4416 wrote to memory of 4336 4416 3E9F.tmp 93 PID 4416 wrote to memory of 4336 4416 3E9F.tmp 93 PID 4336 wrote to memory of 216 4336 3EED.tmp 94 PID 4336 wrote to memory of 216 4336 3EED.tmp 94 PID 4336 wrote to memory of 216 4336 3EED.tmp 94 PID 216 wrote to memory of 4952 216 3F4B.tmp 95 PID 216 wrote to memory of 4952 216 3F4B.tmp 95 PID 216 wrote to memory of 4952 216 3F4B.tmp 95 PID 4952 wrote to memory of 2132 4952 3FA9.tmp 96 PID 4952 wrote to memory of 2132 4952 3FA9.tmp 96 PID 4952 wrote to memory of 2132 4952 3FA9.tmp 96 PID 2132 wrote to memory of 808 2132 4035.tmp 97 PID 2132 wrote to memory of 808 2132 4035.tmp 97 PID 2132 wrote to memory of 808 2132 4035.tmp 97 PID 808 wrote to memory of 4828 808 40B2.tmp 98 PID 808 wrote to memory of 4828 808 40B2.tmp 98 PID 808 wrote to memory of 4828 808 40B2.tmp 98 PID 4828 wrote to memory of 3968 4828 412F.tmp 99 PID 4828 wrote to memory of 3968 4828 412F.tmp 99 PID 4828 wrote to memory of 3968 4828 412F.tmp 99 PID 3968 wrote to memory of 2892 3968 418D.tmp 100 PID 3968 wrote to memory of 2892 3968 418D.tmp 100 PID 3968 wrote to memory of 2892 3968 418D.tmp 100 PID 2892 wrote to memory of 3232 2892 420A.tmp 101 PID 2892 wrote to memory of 3232 2892 420A.tmp 101 PID 2892 wrote to memory of 3232 2892 420A.tmp 101 PID 3232 wrote to memory of 4552 3232 4268.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_0fcb533ee73b6772bc9f19a39b4d0e37_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"23⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"24⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"25⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"27⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"28⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"29⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"30⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"31⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"32⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"33⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"34⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"35⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"36⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"37⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"38⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"39⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"40⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"41⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"42⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"43⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"44⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"45⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"46⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"47⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"48⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"49⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"50⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"51⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"52⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"53⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"54⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"55⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"56⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"57⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"58⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"59⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"60⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"61⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"62⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"63⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"64⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"65⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"66⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"67⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"68⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"69⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"70⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"71⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"72⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"73⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"75⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"76⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"77⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"78⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"79⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"81⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"82⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"83⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"84⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"85⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"86⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"87⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"88⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"89⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"90⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"91⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"92⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"93⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"94⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"95⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"96⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"97⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"98⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"99⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"100⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"101⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"102⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"103⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"104⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"105⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"106⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"107⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"108⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"109⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"110⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"111⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"112⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"113⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"114⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"115⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"116⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"117⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"118⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"119⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"120⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"121⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-