Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe
-
Size
520KB
-
MD5
200e0cffbe4b46e961f4e379e6aeb535
-
SHA1
70b259ab4c57ee09ff39b3767f16f08ce28a5bbb
-
SHA256
923fadeb9011296993a94206f36962d2335da51199314e8af321618c8d2b55a0
-
SHA512
4bc9f6683334c2e9e5acc6746efc116185396f816100e3d9896238fa066feda1670bce541ff9ab5631b937517be6a5fd00e0e26bab061731f93a096e3fc57b1f
-
SSDEEP
6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbXcMqN0eTpJvw8ExI6cdeZ/kqDPVlGGqt9:gj8fuxR21t5i8fpAKpvEwUCq3GuCNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4824 4C1C.tmp 212 4C7A.tmp 3808 4CF7.tmp 1600 4D84.tmp 3928 4E01.tmp 5056 4E6E.tmp 2396 4EDB.tmp 1904 4F39.tmp 2348 4F97.tmp 1640 4FF5.tmp 1912 5052.tmp 4520 50C0.tmp 1488 511D.tmp 2520 517B.tmp 2880 51F8.tmp 4716 5266.tmp 2252 52C3.tmp 2764 5331.tmp 3184 538E.tmp 376 53DD.tmp 1432 544A.tmp 3136 5498.tmp 3220 54F6.tmp 3232 5554.tmp 1128 55C1.tmp 3364 560F.tmp 2104 566D.tmp 544 56DA.tmp 1032 5738.tmp 4796 57A5.tmp 8 5813.tmp 3996 5861.tmp 3464 58CE.tmp 2524 592C.tmp 2976 597A.tmp 4028 59D8.tmp 3456 5A26.tmp 3052 5A74.tmp 1512 5AC2.tmp 3392 5B20.tmp 2012 5B6E.tmp 2996 5BCC.tmp 1112 5C2A.tmp 4748 5C78.tmp 5088 5CC6.tmp 4356 5D14.tmp 220 5D62.tmp 3808 5DB0.tmp 896 5DFE.tmp 4788 5E5C.tmp 4552 5EBA.tmp 5036 5F18.tmp 2812 5F75.tmp 1944 5FC3.tmp 2396 6012.tmp 2708 606F.tmp 456 60BD.tmp 4660 611B.tmp 468 6179.tmp 3152 61C7.tmp 3860 6215.tmp 3248 6273.tmp 1488 62D1.tmp 2332 632E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 4824 2444 2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe 82 PID 2444 wrote to memory of 4824 2444 2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe 82 PID 2444 wrote to memory of 4824 2444 2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe 82 PID 4824 wrote to memory of 212 4824 4C1C.tmp 83 PID 4824 wrote to memory of 212 4824 4C1C.tmp 83 PID 4824 wrote to memory of 212 4824 4C1C.tmp 83 PID 212 wrote to memory of 3808 212 4C7A.tmp 84 PID 212 wrote to memory of 3808 212 4C7A.tmp 84 PID 212 wrote to memory of 3808 212 4C7A.tmp 84 PID 3808 wrote to memory of 1600 3808 4CF7.tmp 86 PID 3808 wrote to memory of 1600 3808 4CF7.tmp 86 PID 3808 wrote to memory of 1600 3808 4CF7.tmp 86 PID 1600 wrote to memory of 3928 1600 4D84.tmp 88 PID 1600 wrote to memory of 3928 1600 4D84.tmp 88 PID 1600 wrote to memory of 3928 1600 4D84.tmp 88 PID 3928 wrote to memory of 5056 3928 4E01.tmp 89 PID 3928 wrote to memory of 5056 3928 4E01.tmp 89 PID 3928 wrote to memory of 5056 3928 4E01.tmp 89 PID 5056 wrote to memory of 2396 5056 4E6E.tmp 91 PID 5056 wrote to memory of 2396 5056 4E6E.tmp 91 PID 5056 wrote to memory of 2396 5056 4E6E.tmp 91 PID 2396 wrote to memory of 1904 2396 4EDB.tmp 92 PID 2396 wrote to memory of 1904 2396 4EDB.tmp 92 PID 2396 wrote to memory of 1904 2396 4EDB.tmp 92 PID 1904 wrote to memory of 2348 1904 4F39.tmp 93 PID 1904 wrote to memory of 2348 1904 4F39.tmp 93 PID 1904 wrote to memory of 2348 1904 4F39.tmp 93 PID 2348 wrote to memory of 1640 2348 4F97.tmp 94 PID 2348 wrote to memory of 1640 2348 4F97.tmp 94 PID 2348 wrote to memory of 1640 2348 4F97.tmp 94 PID 1640 wrote to memory of 1912 1640 4FF5.tmp 95 PID 1640 wrote to memory of 1912 1640 4FF5.tmp 95 PID 1640 wrote to memory of 1912 1640 4FF5.tmp 95 PID 1912 wrote to memory of 4520 1912 5052.tmp 96 PID 1912 wrote to memory of 4520 1912 5052.tmp 96 PID 1912 wrote to memory of 4520 1912 5052.tmp 96 PID 4520 wrote to memory of 1488 4520 50C0.tmp 97 PID 4520 wrote to memory of 1488 4520 50C0.tmp 97 PID 4520 wrote to memory of 1488 4520 50C0.tmp 97 PID 1488 wrote to memory of 2520 1488 511D.tmp 98 PID 1488 wrote to memory of 2520 1488 511D.tmp 98 PID 1488 wrote to memory of 2520 1488 511D.tmp 98 PID 2520 wrote to memory of 2880 2520 517B.tmp 99 PID 2520 wrote to memory of 2880 2520 517B.tmp 99 PID 2520 wrote to memory of 2880 2520 517B.tmp 99 PID 2880 wrote to memory of 4716 2880 51F8.tmp 100 PID 2880 wrote to memory of 4716 2880 51F8.tmp 100 PID 2880 wrote to memory of 4716 2880 51F8.tmp 100 PID 4716 wrote to memory of 2252 4716 5266.tmp 101 PID 4716 wrote to memory of 2252 4716 5266.tmp 101 PID 4716 wrote to memory of 2252 4716 5266.tmp 101 PID 2252 wrote to memory of 2764 2252 52C3.tmp 102 PID 2252 wrote to memory of 2764 2252 52C3.tmp 102 PID 2252 wrote to memory of 2764 2252 52C3.tmp 102 PID 2764 wrote to memory of 3184 2764 5331.tmp 103 PID 2764 wrote to memory of 3184 2764 5331.tmp 103 PID 2764 wrote to memory of 3184 2764 5331.tmp 103 PID 3184 wrote to memory of 376 3184 538E.tmp 104 PID 3184 wrote to memory of 376 3184 538E.tmp 104 PID 3184 wrote to memory of 376 3184 538E.tmp 104 PID 376 wrote to memory of 1432 376 53DD.tmp 105 PID 376 wrote to memory of 1432 376 53DD.tmp 105 PID 376 wrote to memory of 1432 376 53DD.tmp 105 PID 1432 wrote to memory of 3136 1432 544A.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_200e0cffbe4b46e961f4e379e6aeb535_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"23⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"24⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"25⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"26⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"27⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"28⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"29⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"30⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"31⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"32⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"33⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"34⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"35⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"36⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"37⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"38⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"39⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"40⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"41⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"42⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"43⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"44⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"45⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"46⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"47⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"48⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"49⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"50⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"51⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"52⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"53⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"54⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"55⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"56⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"57⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"58⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"59⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"60⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"61⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"62⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"63⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"64⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"65⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"66⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"67⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"68⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"69⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"70⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"71⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"72⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"73⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"74⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"75⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"76⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"77⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"78⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"79⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"80⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"81⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"83⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"84⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"85⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"86⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"87⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"88⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"89⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"90⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"91⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"92⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"93⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"94⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"95⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"96⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"97⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"98⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"99⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"100⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"101⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"102⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"104⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"105⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"106⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"107⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"108⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"109⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"110⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"111⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"112⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"113⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"114⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"115⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"116⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"117⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"118⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"119⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"120⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"121⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"122⤵PID:4620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-