Analysis
-
max time kernel
26s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe
Resource
win7-20240215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe
-
Size
520KB
-
MD5
26dd0344e6cfb96674bdfabdc92d841a
-
SHA1
043879f2ebc0b024c0749457b72e2a0f0f35838a
-
SHA256
c517a3ca8dd22cb99fe67b449ceb8420994f2a18d68654187fad493c3c48c83d
-
SHA512
7fef4804f3521392c546081619fea58dc29bfaa7642b28624a7976caa0384c88da19e8ef6401b8e363ffdf73d894a04f8d74ba72a87d4451788e0eeaaac9a020
-
SSDEEP
12288:gj8fuxR21t5i8fdupQAIkqpHrK/y3feVXO2vUayGGNZ:gj8fuK1GYYpP1qpG6veVXO2sauN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3796 7520.tmp 3620 758E.tmp 532 75EB.tmp 2972 76A7.tmp 1020 7743.tmp 216 77DF.tmp 4872 787C.tmp 3212 78F9.tmp 1184 79A4.tmp 4348 7A02.tmp 4412 7A60.tmp 2756 7AFC.tmp 4732 7C92.tmp 1580 7D0F.tmp 1988 7D9C.tmp 2428 7E09.tmp 2044 7EA6.tmp 3776 7F13.tmp 1608 7F71.tmp 4520 7FEE.tmp 3188 805B.tmp 4424 80D8.tmp 4460 8146.tmp 680 81D2.tmp 4920 8240.tmp 3600 82BD.tmp 4764 832A.tmp 3580 8378.tmp 3724 8405.tmp 3512 8491.tmp 1404 851E.tmp 3296 858B.tmp 5048 85F9.tmp 968 8647.tmp 4980 86B4.tmp 5032 8712.tmp 1232 8760.tmp 764 87AE.tmp 1148 87FC.tmp 3204 884A.tmp 4828 8899.tmp 1528 88E7.tmp 1120 8935.tmp 4872 8983.tmp 3212 89D1.tmp 2676 8A1F.tmp 4500 8A6D.tmp 4376 8ABB.tmp 4412 8B0A.tmp 1636 8B58.tmp 2756 8BA6.tmp 1112 8BF4.tmp 3164 8C42.tmp 520 8C90.tmp 1988 8CDE.tmp 1724 8D2C.tmp 4432 8D7B.tmp 1296 8DC9.tmp 900 8E17.tmp 1608 8E65.tmp 4932 8EB3.tmp 2492 8F01.tmp 4640 8F4F.tmp 4592 8F9D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3796 4532 2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe 83 PID 4532 wrote to memory of 3796 4532 2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe 83 PID 4532 wrote to memory of 3796 4532 2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe 83 PID 3796 wrote to memory of 3620 3796 7520.tmp 84 PID 3796 wrote to memory of 3620 3796 7520.tmp 84 PID 3796 wrote to memory of 3620 3796 7520.tmp 84 PID 3620 wrote to memory of 532 3620 758E.tmp 85 PID 3620 wrote to memory of 532 3620 758E.tmp 85 PID 3620 wrote to memory of 532 3620 758E.tmp 85 PID 532 wrote to memory of 2972 532 75EB.tmp 86 PID 532 wrote to memory of 2972 532 75EB.tmp 86 PID 532 wrote to memory of 2972 532 75EB.tmp 86 PID 2972 wrote to memory of 1020 2972 76A7.tmp 88 PID 2972 wrote to memory of 1020 2972 76A7.tmp 88 PID 2972 wrote to memory of 1020 2972 76A7.tmp 88 PID 1020 wrote to memory of 216 1020 7743.tmp 89 PID 1020 wrote to memory of 216 1020 7743.tmp 89 PID 1020 wrote to memory of 216 1020 7743.tmp 89 PID 216 wrote to memory of 4872 216 77DF.tmp 91 PID 216 wrote to memory of 4872 216 77DF.tmp 91 PID 216 wrote to memory of 4872 216 77DF.tmp 91 PID 4872 wrote to memory of 3212 4872 787C.tmp 92 PID 4872 wrote to memory of 3212 4872 787C.tmp 92 PID 4872 wrote to memory of 3212 4872 787C.tmp 92 PID 3212 wrote to memory of 1184 3212 78F9.tmp 94 PID 3212 wrote to memory of 1184 3212 78F9.tmp 94 PID 3212 wrote to memory of 1184 3212 78F9.tmp 94 PID 1184 wrote to memory of 4348 1184 79A4.tmp 95 PID 1184 wrote to memory of 4348 1184 79A4.tmp 95 PID 1184 wrote to memory of 4348 1184 79A4.tmp 95 PID 4348 wrote to memory of 4412 4348 7A02.tmp 96 PID 4348 wrote to memory of 4412 4348 7A02.tmp 96 PID 4348 wrote to memory of 4412 4348 7A02.tmp 96 PID 4412 wrote to memory of 2756 4412 7A60.tmp 97 PID 4412 wrote to memory of 2756 4412 7A60.tmp 97 PID 4412 wrote to memory of 2756 4412 7A60.tmp 97 PID 2756 wrote to memory of 4732 2756 7AFC.tmp 98 PID 2756 wrote to memory of 4732 2756 7AFC.tmp 98 PID 2756 wrote to memory of 4732 2756 7AFC.tmp 98 PID 4732 wrote to memory of 1580 4732 7C92.tmp 99 PID 4732 wrote to memory of 1580 4732 7C92.tmp 99 PID 4732 wrote to memory of 1580 4732 7C92.tmp 99 PID 1580 wrote to memory of 1988 1580 7D0F.tmp 100 PID 1580 wrote to memory of 1988 1580 7D0F.tmp 100 PID 1580 wrote to memory of 1988 1580 7D0F.tmp 100 PID 1988 wrote to memory of 2428 1988 7D9C.tmp 101 PID 1988 wrote to memory of 2428 1988 7D9C.tmp 101 PID 1988 wrote to memory of 2428 1988 7D9C.tmp 101 PID 2428 wrote to memory of 2044 2428 7E09.tmp 102 PID 2428 wrote to memory of 2044 2428 7E09.tmp 102 PID 2428 wrote to memory of 2044 2428 7E09.tmp 102 PID 2044 wrote to memory of 3776 2044 7EA6.tmp 103 PID 2044 wrote to memory of 3776 2044 7EA6.tmp 103 PID 2044 wrote to memory of 3776 2044 7EA6.tmp 103 PID 3776 wrote to memory of 1608 3776 7F13.tmp 104 PID 3776 wrote to memory of 1608 3776 7F13.tmp 104 PID 3776 wrote to memory of 1608 3776 7F13.tmp 104 PID 1608 wrote to memory of 4520 1608 7F71.tmp 105 PID 1608 wrote to memory of 4520 1608 7F71.tmp 105 PID 1608 wrote to memory of 4520 1608 7F71.tmp 105 PID 4520 wrote to memory of 3188 4520 7FEE.tmp 108 PID 4520 wrote to memory of 3188 4520 7FEE.tmp 108 PID 4520 wrote to memory of 3188 4520 7FEE.tmp 108 PID 3188 wrote to memory of 4424 3188 805B.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_26dd0344e6cfb96674bdfabdc92d841a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"23⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"24⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"25⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"26⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"27⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"28⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"29⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"30⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"31⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"32⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"33⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"34⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"35⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"36⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"37⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"38⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"39⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"40⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"41⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"42⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"43⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"44⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"45⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"46⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"47⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"48⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"49⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"50⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"51⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"52⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"53⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"54⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"55⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"56⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"57⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"58⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"59⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"60⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"61⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"62⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"63⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"64⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"65⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"66⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"67⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"68⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"69⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"70⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"71⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"72⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"73⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"74⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"75⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"76⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"77⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"78⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"79⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"80⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"81⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"82⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"83⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"84⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"85⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"86⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"87⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"88⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"89⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"91⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"92⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"93⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"94⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"95⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"96⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"97⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"98⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"99⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"100⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"101⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"102⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"103⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"104⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"105⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"106⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"107⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"108⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"109⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"110⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"111⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"112⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"113⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"114⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"115⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"116⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"117⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"118⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"119⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"120⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-