Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe
-
Size
486KB
-
MD5
3f91fbd6b3e027ab2dd0b2f5107690f3
-
SHA1
78eeb74018110ee79c1fe1467372b8faeb96292b
-
SHA256
37dff4a6862c96a20eea69d9c4de6c407efe2a5fd7468614f37a78db774e9525
-
SHA512
e8d765ac9ded6a332dbb571ecda811e271638ea64c8a84eceea83039d1d5c92d77cb55ead0d48e1b10fcf061d9461c6aa75b9a5738889f133905a33c36689c2a
-
SSDEEP
12288:UU5rCOTeiDz3Jj3wzHUByYlnB/n7xmYMNZ:UUQOJDdj3T9Bf74ZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1284 4DC2.tmp 4464 4E2F.tmp 3224 4EAC.tmp 1108 4F39.tmp 1388 4FB6.tmp 1620 5014.tmp 1400 5081.tmp 932 50DF.tmp 3504 513D.tmp 4844 518B.tmp 1568 5208.tmp 4080 5275.tmp 3796 52F2.tmp 5108 5350.tmp 4148 53BD.tmp 4084 542B.tmp 1248 5498.tmp 2128 5505.tmp 1924 5563.tmp 3916 55D1.tmp 3616 561F.tmp 4716 56AB.tmp 1612 5709.tmp 4736 5757.tmp 1524 57C5.tmp 3216 5832.tmp 4036 5880.tmp 3728 58CE.tmp 1332 594B.tmp 4468 5999.tmp 4640 59E7.tmp 1840 5A55.tmp 4224 5AD2.tmp 5060 5B20.tmp 3624 5B6E.tmp 2704 5C0A.tmp 368 5C68.tmp 4512 5CB6.tmp 5032 5D04.tmp 4608 5D52.tmp 3056 5DB0.tmp 3844 5DFE.tmp 3476 5E4C.tmp 1052 5E9B.tmp 3960 5EE9.tmp 1716 5F46.tmp 1892 5FA4.tmp 4336 6021.tmp 2576 60AE.tmp 1496 615A.tmp 3908 6244.tmp 1980 632E.tmp 408 63BB.tmp 1984 6486.tmp 3456 6580.tmp 1812 65EE.tmp 2072 667A.tmp 4072 66D8.tmp 1372 6736.tmp 2236 6793.tmp 4928 67F1.tmp 3008 683F.tmp 2668 68AD.tmp 1248 691A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3612 wrote to memory of 1284 3612 2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe 82 PID 3612 wrote to memory of 1284 3612 2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe 82 PID 3612 wrote to memory of 1284 3612 2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe 82 PID 1284 wrote to memory of 4464 1284 4DC2.tmp 83 PID 1284 wrote to memory of 4464 1284 4DC2.tmp 83 PID 1284 wrote to memory of 4464 1284 4DC2.tmp 83 PID 4464 wrote to memory of 3224 4464 4E2F.tmp 85 PID 4464 wrote to memory of 3224 4464 4E2F.tmp 85 PID 4464 wrote to memory of 3224 4464 4E2F.tmp 85 PID 3224 wrote to memory of 1108 3224 4EAC.tmp 88 PID 3224 wrote to memory of 1108 3224 4EAC.tmp 88 PID 3224 wrote to memory of 1108 3224 4EAC.tmp 88 PID 1108 wrote to memory of 1388 1108 4F39.tmp 89 PID 1108 wrote to memory of 1388 1108 4F39.tmp 89 PID 1108 wrote to memory of 1388 1108 4F39.tmp 89 PID 1388 wrote to memory of 1620 1388 4FB6.tmp 90 PID 1388 wrote to memory of 1620 1388 4FB6.tmp 90 PID 1388 wrote to memory of 1620 1388 4FB6.tmp 90 PID 1620 wrote to memory of 1400 1620 5014.tmp 91 PID 1620 wrote to memory of 1400 1620 5014.tmp 91 PID 1620 wrote to memory of 1400 1620 5014.tmp 91 PID 1400 wrote to memory of 932 1400 5081.tmp 92 PID 1400 wrote to memory of 932 1400 5081.tmp 92 PID 1400 wrote to memory of 932 1400 5081.tmp 92 PID 932 wrote to memory of 3504 932 50DF.tmp 93 PID 932 wrote to memory of 3504 932 50DF.tmp 93 PID 932 wrote to memory of 3504 932 50DF.tmp 93 PID 3504 wrote to memory of 4844 3504 513D.tmp 94 PID 3504 wrote to memory of 4844 3504 513D.tmp 94 PID 3504 wrote to memory of 4844 3504 513D.tmp 94 PID 4844 wrote to memory of 1568 4844 518B.tmp 95 PID 4844 wrote to memory of 1568 4844 518B.tmp 95 PID 4844 wrote to memory of 1568 4844 518B.tmp 95 PID 1568 wrote to memory of 4080 1568 5208.tmp 96 PID 1568 wrote to memory of 4080 1568 5208.tmp 96 PID 1568 wrote to memory of 4080 1568 5208.tmp 96 PID 4080 wrote to memory of 3796 4080 5275.tmp 97 PID 4080 wrote to memory of 3796 4080 5275.tmp 97 PID 4080 wrote to memory of 3796 4080 5275.tmp 97 PID 3796 wrote to memory of 5108 3796 52F2.tmp 98 PID 3796 wrote to memory of 5108 3796 52F2.tmp 98 PID 3796 wrote to memory of 5108 3796 52F2.tmp 98 PID 5108 wrote to memory of 4148 5108 5350.tmp 99 PID 5108 wrote to memory of 4148 5108 5350.tmp 99 PID 5108 wrote to memory of 4148 5108 5350.tmp 99 PID 4148 wrote to memory of 4084 4148 53BD.tmp 100 PID 4148 wrote to memory of 4084 4148 53BD.tmp 100 PID 4148 wrote to memory of 4084 4148 53BD.tmp 100 PID 4084 wrote to memory of 1248 4084 542B.tmp 101 PID 4084 wrote to memory of 1248 4084 542B.tmp 101 PID 4084 wrote to memory of 1248 4084 542B.tmp 101 PID 1248 wrote to memory of 2128 1248 5498.tmp 102 PID 1248 wrote to memory of 2128 1248 5498.tmp 102 PID 1248 wrote to memory of 2128 1248 5498.tmp 102 PID 2128 wrote to memory of 1924 2128 5505.tmp 103 PID 2128 wrote to memory of 1924 2128 5505.tmp 103 PID 2128 wrote to memory of 1924 2128 5505.tmp 103 PID 1924 wrote to memory of 3916 1924 5563.tmp 104 PID 1924 wrote to memory of 3916 1924 5563.tmp 104 PID 1924 wrote to memory of 3916 1924 5563.tmp 104 PID 3916 wrote to memory of 3616 3916 55D1.tmp 105 PID 3916 wrote to memory of 3616 3916 55D1.tmp 105 PID 3916 wrote to memory of 3616 3916 55D1.tmp 105 PID 3616 wrote to memory of 4716 3616 561F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_3f91fbd6b3e027ab2dd0b2f5107690f3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"23⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"24⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"25⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"26⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"27⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"28⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"29⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"30⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"31⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"32⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"33⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"34⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"35⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"36⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"37⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"38⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"39⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"40⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"41⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"42⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"43⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"45⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"46⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"47⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"48⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"49⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"50⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"51⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"52⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"53⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"54⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"55⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"56⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"57⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"58⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"59⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"60⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"61⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"62⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"63⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"64⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"65⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"66⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"67⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"68⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"69⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"70⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"71⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"72⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"73⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"74⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"75⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"76⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"77⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"78⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"79⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"80⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"81⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"82⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"83⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"84⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"85⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"86⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"87⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"88⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"89⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"90⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"91⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"92⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"93⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"94⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"95⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"96⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"97⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"98⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"99⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"100⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"101⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"102⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"103⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"104⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"105⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"106⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"107⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"108⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"109⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"110⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"111⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"112⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"113⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"114⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"115⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"116⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"117⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"118⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"119⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"120⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"121⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-