Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe
-
Size
765KB
-
MD5
06ad7a7f936bcbf57e921de2be14c667
-
SHA1
5d5bc563788ae0d605a96ceef15580e6aaedb02e
-
SHA256
89798434e82b4f170db308e96331361476ad4da09da5fd8735a84e03815dadc3
-
SHA512
e6402023d1fb23c985f094f02481a21352700c6653f6d254d384c052906891b0fa3db296ae87915b75b3b716e31fe4ab62c8da912c5ba69d16609385f4fd2807
-
SSDEEP
12288:ZU5rCOTeiDknUn1HWrPcW3ZF5rn5rLOa54U5w5A:ZUQOJD8C1HWR3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4316 4EBC.tmp 4896 4F39.tmp 4264 4FA6.tmp 4400 5033.tmp 4824 50DF.tmp 2600 515C.tmp 4208 51D9.tmp 1612 5256.tmp 4980 52C3.tmp 1856 5331.tmp 2324 539E.tmp 4788 540B.tmp 60 5479.tmp 404 54F6.tmp 812 5573.tmp 2396 55FF.tmp 1944 568C.tmp 1708 5719.tmp 1064 57B5.tmp 4876 5832.tmp 2940 589F.tmp 5052 592C.tmp 4580 59B9.tmp 4812 5A36.tmp 1484 5AB3.tmp 5092 5B20.tmp 3224 5B9D.tmp 2552 5BFB.tmp 4716 5C68.tmp 4352 5CD5.tmp 4656 5D43.tmp 4620 5DA1.tmp 3108 5DFE.tmp 4184 5E5C.tmp 4516 5EBA.tmp 1432 5F08.tmp 3144 5F66.tmp 1840 5FC3.tmp 920 6021.tmp 1000 607F.tmp 5012 60DD.tmp 4652 613A.tmp 3564 6198.tmp 2104 61E6.tmp 2648 6254.tmp 2556 62B1.tmp 1552 630F.tmp 4796 636D.tmp 1932 63CB.tmp 4856 6419.tmp 2712 6467.tmp 3620 64C5.tmp 4076 6513.tmp 1936 6561.tmp 3208 65AF.tmp 4964 660D.tmp 4888 666B.tmp 2100 66B9.tmp 4540 6716.tmp 1244 6774.tmp 2020 67C2.tmp 2512 6820.tmp 1404 687E.tmp 4596 68DC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 4316 1820 2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe 81 PID 1820 wrote to memory of 4316 1820 2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe 81 PID 1820 wrote to memory of 4316 1820 2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe 81 PID 4316 wrote to memory of 4896 4316 4EBC.tmp 82 PID 4316 wrote to memory of 4896 4316 4EBC.tmp 82 PID 4316 wrote to memory of 4896 4316 4EBC.tmp 82 PID 4896 wrote to memory of 4264 4896 4F39.tmp 83 PID 4896 wrote to memory of 4264 4896 4F39.tmp 83 PID 4896 wrote to memory of 4264 4896 4F39.tmp 83 PID 4264 wrote to memory of 4400 4264 4FA6.tmp 84 PID 4264 wrote to memory of 4400 4264 4FA6.tmp 84 PID 4264 wrote to memory of 4400 4264 4FA6.tmp 84 PID 4400 wrote to memory of 4824 4400 5033.tmp 85 PID 4400 wrote to memory of 4824 4400 5033.tmp 85 PID 4400 wrote to memory of 4824 4400 5033.tmp 85 PID 4824 wrote to memory of 2600 4824 50DF.tmp 86 PID 4824 wrote to memory of 2600 4824 50DF.tmp 86 PID 4824 wrote to memory of 2600 4824 50DF.tmp 86 PID 2600 wrote to memory of 4208 2600 515C.tmp 87 PID 2600 wrote to memory of 4208 2600 515C.tmp 87 PID 2600 wrote to memory of 4208 2600 515C.tmp 87 PID 4208 wrote to memory of 1612 4208 51D9.tmp 88 PID 4208 wrote to memory of 1612 4208 51D9.tmp 88 PID 4208 wrote to memory of 1612 4208 51D9.tmp 88 PID 1612 wrote to memory of 4980 1612 5256.tmp 89 PID 1612 wrote to memory of 4980 1612 5256.tmp 89 PID 1612 wrote to memory of 4980 1612 5256.tmp 89 PID 4980 wrote to memory of 1856 4980 52C3.tmp 90 PID 4980 wrote to memory of 1856 4980 52C3.tmp 90 PID 4980 wrote to memory of 1856 4980 52C3.tmp 90 PID 1856 wrote to memory of 2324 1856 5331.tmp 91 PID 1856 wrote to memory of 2324 1856 5331.tmp 91 PID 1856 wrote to memory of 2324 1856 5331.tmp 91 PID 2324 wrote to memory of 4788 2324 539E.tmp 92 PID 2324 wrote to memory of 4788 2324 539E.tmp 92 PID 2324 wrote to memory of 4788 2324 539E.tmp 92 PID 4788 wrote to memory of 60 4788 540B.tmp 93 PID 4788 wrote to memory of 60 4788 540B.tmp 93 PID 4788 wrote to memory of 60 4788 540B.tmp 93 PID 60 wrote to memory of 404 60 5479.tmp 94 PID 60 wrote to memory of 404 60 5479.tmp 94 PID 60 wrote to memory of 404 60 5479.tmp 94 PID 404 wrote to memory of 812 404 54F6.tmp 95 PID 404 wrote to memory of 812 404 54F6.tmp 95 PID 404 wrote to memory of 812 404 54F6.tmp 95 PID 812 wrote to memory of 2396 812 5573.tmp 96 PID 812 wrote to memory of 2396 812 5573.tmp 96 PID 812 wrote to memory of 2396 812 5573.tmp 96 PID 2396 wrote to memory of 1944 2396 55FF.tmp 97 PID 2396 wrote to memory of 1944 2396 55FF.tmp 97 PID 2396 wrote to memory of 1944 2396 55FF.tmp 97 PID 1944 wrote to memory of 1708 1944 568C.tmp 98 PID 1944 wrote to memory of 1708 1944 568C.tmp 98 PID 1944 wrote to memory of 1708 1944 568C.tmp 98 PID 1708 wrote to memory of 1064 1708 5719.tmp 99 PID 1708 wrote to memory of 1064 1708 5719.tmp 99 PID 1708 wrote to memory of 1064 1708 5719.tmp 99 PID 1064 wrote to memory of 4876 1064 57B5.tmp 100 PID 1064 wrote to memory of 4876 1064 57B5.tmp 100 PID 1064 wrote to memory of 4876 1064 57B5.tmp 100 PID 4876 wrote to memory of 2940 4876 5832.tmp 101 PID 4876 wrote to memory of 2940 4876 5832.tmp 101 PID 4876 wrote to memory of 2940 4876 5832.tmp 101 PID 2940 wrote to memory of 5052 2940 589F.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_06ad7a7f936bcbf57e921de2be14c667_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"23⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"24⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"25⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"26⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"27⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"28⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"29⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"30⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"31⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"32⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"33⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"34⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"35⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"36⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"37⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"38⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"39⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"40⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"41⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"42⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"43⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"44⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"45⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"46⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"47⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"48⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"49⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"50⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"51⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"52⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"53⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"54⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"55⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"56⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"57⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"58⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"59⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"60⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"61⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"62⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"63⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"64⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"65⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"66⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"67⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"68⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"69⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"70⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"71⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"72⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"73⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"74⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"75⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"76⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"77⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"78⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"79⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"80⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"82⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"83⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"84⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"85⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"86⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"87⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"88⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"89⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"90⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"91⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"92⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"93⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"94⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"95⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"96⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"97⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"98⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"99⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"100⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"101⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"102⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"103⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"104⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"105⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"106⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"107⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"108⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"109⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"110⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"111⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"112⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"113⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"114⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"115⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"116⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"117⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"118⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"119⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"120⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"121⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-