Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe
-
Size
488KB
-
MD5
0436ac7774b0f32ed19eadade34c6588
-
SHA1
7d395eb9a525c29741b7076bb108a3c2bae5f228
-
SHA256
8ed1ce08e4c39bf5375748f02752d16fc9f130051849c65297c00a81adce1152
-
SHA512
3feb309b3fa43e5843d75d44db16dfd517456b30abb8d4d60b79ca79dff50576443b585427ce2030cbba0b12cd66ceeef378e13e712fa083d862b4312955395e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7A61csBXX82zn1iWm9LZTTigBixsEy2wa32Tm:/U5rCOTeiDT7X82fm9PgyEyaNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2088 5999.tmp 4060 5A55.tmp 4864 5AF1.tmp 3860 5BAD.tmp 1396 5C2A.tmp 2036 5CD5.tmp 3152 5D91.tmp 3120 5E2D.tmp 2468 5EC9.tmp 2520 5F75.tmp 2120 608F.tmp 1892 62E0.tmp 4356 63AB.tmp 4948 6448.tmp 1860 6503.tmp 2308 6580.tmp 3128 661C.tmp 3840 66E8.tmp 1428 67C2.tmp 984 683F.tmp 2936 68DC.tmp 4296 6997.tmp 3984 6A53.tmp 940 6B7B.tmp 2464 6BF8.tmp 4996 6CB4.tmp 4232 6D7F.tmp 3572 6E1B.tmp 1312 6F06.tmp 4036 6FC1.tmp 4572 704E.tmp 1832 70EA.tmp 2956 7196.tmp 2620 7251.tmp 5024 730D.tmp 2284 739A.tmp 5072 7417.tmp 1576 74A3.tmp 3248 7520.tmp 1452 75CC.tmp 1176 7649.tmp 4080 76D6.tmp 2216 7762.tmp 4088 77FF.tmp 1068 788B.tmp 1524 7927.tmp 3888 7995.tmp 4688 7A02.tmp 228 7A7F.tmp 4316 7B0C.tmp 5032 7C25.tmp 2720 7CA2.tmp 4596 7D1F.tmp 2672 7DBB.tmp 4668 7E58.tmp 2428 7ED5.tmp 5004 7F71.tmp 2520 800D.tmp 1492 8136.tmp 1228 81C3.tmp 4512 825F.tmp 2204 82EB.tmp 368 8397.tmp 4948 8414.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2088 1624 2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe 86 PID 1624 wrote to memory of 2088 1624 2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe 86 PID 1624 wrote to memory of 2088 1624 2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe 86 PID 2088 wrote to memory of 4060 2088 5999.tmp 88 PID 2088 wrote to memory of 4060 2088 5999.tmp 88 PID 2088 wrote to memory of 4060 2088 5999.tmp 88 PID 4060 wrote to memory of 4864 4060 5A55.tmp 89 PID 4060 wrote to memory of 4864 4060 5A55.tmp 89 PID 4060 wrote to memory of 4864 4060 5A55.tmp 89 PID 4864 wrote to memory of 3860 4864 5AF1.tmp 91 PID 4864 wrote to memory of 3860 4864 5AF1.tmp 91 PID 4864 wrote to memory of 3860 4864 5AF1.tmp 91 PID 3860 wrote to memory of 1396 3860 5BAD.tmp 92 PID 3860 wrote to memory of 1396 3860 5BAD.tmp 92 PID 3860 wrote to memory of 1396 3860 5BAD.tmp 92 PID 1396 wrote to memory of 2036 1396 5C2A.tmp 94 PID 1396 wrote to memory of 2036 1396 5C2A.tmp 94 PID 1396 wrote to memory of 2036 1396 5C2A.tmp 94 PID 2036 wrote to memory of 3152 2036 5CD5.tmp 95 PID 2036 wrote to memory of 3152 2036 5CD5.tmp 95 PID 2036 wrote to memory of 3152 2036 5CD5.tmp 95 PID 3152 wrote to memory of 3120 3152 5D91.tmp 96 PID 3152 wrote to memory of 3120 3152 5D91.tmp 96 PID 3152 wrote to memory of 3120 3152 5D91.tmp 96 PID 3120 wrote to memory of 2468 3120 5E2D.tmp 97 PID 3120 wrote to memory of 2468 3120 5E2D.tmp 97 PID 3120 wrote to memory of 2468 3120 5E2D.tmp 97 PID 2468 wrote to memory of 2520 2468 5EC9.tmp 98 PID 2468 wrote to memory of 2520 2468 5EC9.tmp 98 PID 2468 wrote to memory of 2520 2468 5EC9.tmp 98 PID 2520 wrote to memory of 2120 2520 5F75.tmp 99 PID 2520 wrote to memory of 2120 2520 5F75.tmp 99 PID 2520 wrote to memory of 2120 2520 5F75.tmp 99 PID 2120 wrote to memory of 1892 2120 608F.tmp 100 PID 2120 wrote to memory of 1892 2120 608F.tmp 100 PID 2120 wrote to memory of 1892 2120 608F.tmp 100 PID 1892 wrote to memory of 4356 1892 62E0.tmp 101 PID 1892 wrote to memory of 4356 1892 62E0.tmp 101 PID 1892 wrote to memory of 4356 1892 62E0.tmp 101 PID 4356 wrote to memory of 4948 4356 63AB.tmp 102 PID 4356 wrote to memory of 4948 4356 63AB.tmp 102 PID 4356 wrote to memory of 4948 4356 63AB.tmp 102 PID 4948 wrote to memory of 1860 4948 6448.tmp 103 PID 4948 wrote to memory of 1860 4948 6448.tmp 103 PID 4948 wrote to memory of 1860 4948 6448.tmp 103 PID 1860 wrote to memory of 2308 1860 6503.tmp 104 PID 1860 wrote to memory of 2308 1860 6503.tmp 104 PID 1860 wrote to memory of 2308 1860 6503.tmp 104 PID 2308 wrote to memory of 3128 2308 6580.tmp 105 PID 2308 wrote to memory of 3128 2308 6580.tmp 105 PID 2308 wrote to memory of 3128 2308 6580.tmp 105 PID 3128 wrote to memory of 3840 3128 661C.tmp 106 PID 3128 wrote to memory of 3840 3128 661C.tmp 106 PID 3128 wrote to memory of 3840 3128 661C.tmp 106 PID 3840 wrote to memory of 1428 3840 66E8.tmp 107 PID 3840 wrote to memory of 1428 3840 66E8.tmp 107 PID 3840 wrote to memory of 1428 3840 66E8.tmp 107 PID 1428 wrote to memory of 984 1428 67C2.tmp 109 PID 1428 wrote to memory of 984 1428 67C2.tmp 109 PID 1428 wrote to memory of 984 1428 67C2.tmp 109 PID 984 wrote to memory of 2936 984 683F.tmp 110 PID 984 wrote to memory of 2936 984 683F.tmp 110 PID 984 wrote to memory of 2936 984 683F.tmp 110 PID 2936 wrote to memory of 4296 2936 68DC.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_0436ac7774b0f32ed19eadade34c6588_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"23⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"24⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"25⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"26⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"27⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"28⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"29⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"30⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"31⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"32⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"33⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"34⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"35⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"36⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"37⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"38⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"39⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"40⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"41⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"42⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"43⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"44⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"45⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"46⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"47⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"48⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"49⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"50⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"51⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"52⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"53⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"54⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"55⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"56⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"57⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"58⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"59⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"60⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"61⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"62⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"63⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"64⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"65⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"66⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"67⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"68⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"69⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"70⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"71⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"72⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"73⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"74⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"75⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"76⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"77⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"78⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"80⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"81⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"82⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"83⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"84⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"85⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"86⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"87⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"89⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"91⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"92⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"93⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"94⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"95⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"96⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"97⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"98⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"99⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"100⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"101⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"102⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"103⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"104⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"105⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"106⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"107⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"108⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"109⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"110⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"111⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"112⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"113⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"114⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"115⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"116⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"117⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"118⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"119⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"120⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"121⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-