Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
-
Size
488KB
-
MD5
40b94fc094b008948fe6d64b31c05cef
-
SHA1
747e196ddf054f36ff1cd64eb3c50f30951418df
-
SHA256
c82b471e7eee0d744379200893abfc0d92a2237d56ede1c25e8a47a63ffbe1e8
-
SHA512
ae3ccd50a2499a76988241c7c8f8fdfacaad04a17a9d47a7a7e964028db4f905bd79134a1722b650332bc434dca0ec2b3ea8153619e962af708da06f9bc1e764
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7sMpaQzQdsM12PINhAjqdajMbITu4807GuLhB:/U5rCOTeiDsM/PsANnuL07fFVNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2780 46BD.tmp 3720 474A.tmp 2320 47B7.tmp 392 4853.tmp 884 48E0.tmp 1104 494D.tmp 4888 49DA.tmp 4140 4A57.tmp 1708 4AB5.tmp 4972 4B41.tmp 1128 4BBE.tmp 3160 4C2C.tmp 5100 4C99.tmp 3752 4D07.tmp 3176 4D84.tmp 1388 4E10.tmp 4248 4E6E.tmp 4540 4ECC.tmp 1688 4F78.tmp 4884 5004.tmp 2308 5081.tmp 1748 50DF.tmp 4760 515C.tmp 2652 51E9.tmp 3452 5285.tmp 4924 5321.tmp 3716 53BD.tmp 3488 542B.tmp 3548 5498.tmp 3776 5505.tmp 4240 5563.tmp 2836 55D1.tmp 5060 564E.tmp 3212 56AB.tmp 2548 5719.tmp 2428 5786.tmp 4288 57D4.tmp 4992 5832.tmp 2440 5880.tmp 228 58DE.tmp 4200 593C.tmp 1376 5999.tmp 3796 59F7.tmp 2996 5A55.tmp 1928 5AB3.tmp 2080 5B20.tmp 3624 5B8D.tmp 3456 5BFB.tmp 2240 5C58.tmp 4576 5CB6.tmp 1452 5D14.tmp 4636 5D62.tmp 4816 5DC0.tmp 1540 5E0E.tmp 2480 5E6C.tmp 436 5EC9.tmp 3628 5F37.tmp 3932 5F95.tmp 1128 5FF2.tmp 1216 6050.tmp 468 60BD.tmp 4612 612B.tmp 2804 6198.tmp 4548 6206.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2780 2912 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 84 PID 2912 wrote to memory of 2780 2912 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 84 PID 2912 wrote to memory of 2780 2912 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 84 PID 2780 wrote to memory of 3720 2780 46BD.tmp 86 PID 2780 wrote to memory of 3720 2780 46BD.tmp 86 PID 2780 wrote to memory of 3720 2780 46BD.tmp 86 PID 3720 wrote to memory of 2320 3720 474A.tmp 88 PID 3720 wrote to memory of 2320 3720 474A.tmp 88 PID 3720 wrote to memory of 2320 3720 474A.tmp 88 PID 2320 wrote to memory of 392 2320 47B7.tmp 89 PID 2320 wrote to memory of 392 2320 47B7.tmp 89 PID 2320 wrote to memory of 392 2320 47B7.tmp 89 PID 392 wrote to memory of 884 392 4853.tmp 90 PID 392 wrote to memory of 884 392 4853.tmp 90 PID 392 wrote to memory of 884 392 4853.tmp 90 PID 884 wrote to memory of 1104 884 48E0.tmp 92 PID 884 wrote to memory of 1104 884 48E0.tmp 92 PID 884 wrote to memory of 1104 884 48E0.tmp 92 PID 1104 wrote to memory of 4888 1104 494D.tmp 93 PID 1104 wrote to memory of 4888 1104 494D.tmp 93 PID 1104 wrote to memory of 4888 1104 494D.tmp 93 PID 4888 wrote to memory of 4140 4888 49DA.tmp 94 PID 4888 wrote to memory of 4140 4888 49DA.tmp 94 PID 4888 wrote to memory of 4140 4888 49DA.tmp 94 PID 4140 wrote to memory of 1708 4140 4A57.tmp 95 PID 4140 wrote to memory of 1708 4140 4A57.tmp 95 PID 4140 wrote to memory of 1708 4140 4A57.tmp 95 PID 1708 wrote to memory of 4972 1708 4AB5.tmp 96 PID 1708 wrote to memory of 4972 1708 4AB5.tmp 96 PID 1708 wrote to memory of 4972 1708 4AB5.tmp 96 PID 4972 wrote to memory of 1128 4972 4B41.tmp 97 PID 4972 wrote to memory of 1128 4972 4B41.tmp 97 PID 4972 wrote to memory of 1128 4972 4B41.tmp 97 PID 1128 wrote to memory of 3160 1128 4BBE.tmp 98 PID 1128 wrote to memory of 3160 1128 4BBE.tmp 98 PID 1128 wrote to memory of 3160 1128 4BBE.tmp 98 PID 3160 wrote to memory of 5100 3160 4C2C.tmp 99 PID 3160 wrote to memory of 5100 3160 4C2C.tmp 99 PID 3160 wrote to memory of 5100 3160 4C2C.tmp 99 PID 5100 wrote to memory of 3752 5100 4C99.tmp 100 PID 5100 wrote to memory of 3752 5100 4C99.tmp 100 PID 5100 wrote to memory of 3752 5100 4C99.tmp 100 PID 3752 wrote to memory of 3176 3752 4D07.tmp 101 PID 3752 wrote to memory of 3176 3752 4D07.tmp 101 PID 3752 wrote to memory of 3176 3752 4D07.tmp 101 PID 3176 wrote to memory of 1388 3176 4D84.tmp 102 PID 3176 wrote to memory of 1388 3176 4D84.tmp 102 PID 3176 wrote to memory of 1388 3176 4D84.tmp 102 PID 1388 wrote to memory of 4248 1388 4E10.tmp 103 PID 1388 wrote to memory of 4248 1388 4E10.tmp 103 PID 1388 wrote to memory of 4248 1388 4E10.tmp 103 PID 4248 wrote to memory of 4540 4248 4E6E.tmp 104 PID 4248 wrote to memory of 4540 4248 4E6E.tmp 104 PID 4248 wrote to memory of 4540 4248 4E6E.tmp 104 PID 4540 wrote to memory of 1688 4540 4ECC.tmp 105 PID 4540 wrote to memory of 1688 4540 4ECC.tmp 105 PID 4540 wrote to memory of 1688 4540 4ECC.tmp 105 PID 1688 wrote to memory of 4884 1688 4F78.tmp 106 PID 1688 wrote to memory of 4884 1688 4F78.tmp 106 PID 1688 wrote to memory of 4884 1688 4F78.tmp 106 PID 4884 wrote to memory of 2308 4884 5004.tmp 107 PID 4884 wrote to memory of 2308 4884 5004.tmp 107 PID 4884 wrote to memory of 2308 4884 5004.tmp 107 PID 2308 wrote to memory of 1748 2308 5081.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"23⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"24⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"25⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"26⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"27⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"28⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"29⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"30⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"31⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"32⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"33⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"34⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"35⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"36⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"37⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"38⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"39⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"40⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"41⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"42⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"43⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"44⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"45⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"46⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"47⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"48⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"49⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"50⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"51⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"52⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"53⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"54⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"55⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"56⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"57⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"58⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"59⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"60⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"61⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"62⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"63⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"64⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"65⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"66⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"68⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"69⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"70⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"71⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"72⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"73⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"74⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"75⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"76⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"77⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"80⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"81⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"82⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"83⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"84⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"85⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"86⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"87⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"88⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"89⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"90⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"91⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"92⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"93⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"94⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"95⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"96⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"97⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"98⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"100⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"101⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"102⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"103⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"104⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"105⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"106⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"107⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"108⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"109⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"110⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"111⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"112⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"113⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"114⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"115⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"116⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"117⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"118⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"119⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"120⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"121⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-