Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
-
Size
536KB
-
MD5
10e8d2523d0368fe6ffc4ce60685bbc1
-
SHA1
29740845a7c3a47feb5b584c763c84a3654fb530
-
SHA256
ae7bd3b5fd9c4f4fad1b4a3594dd9242a572df01053a978cb3c7d9539f38360c
-
SHA512
efa64feec22b2dc065be3a6a76e9a58282c7e82aeafddc991c4e069ae2e3f971931d2b85b88654053a6e77858a1028b6f98d800f0cd045c6ff0881588cab7af1
-
SSDEEP
12288:wU5rCOTeiUE26NLHWkanwASv8R5K2jQCeFbrDqgxTIZxVJ0ZT9:wUQOJUE26NEwkRbkCeTZIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1508 5227.tmp 1876 52A4.tmp 816 5340.tmp 4856 53FC.tmp 780 5498.tmp 4376 5544.tmp 4124 55B1.tmp 4284 561F.tmp 2396 56AB.tmp 3648 5748.tmp 3492 57B5.tmp 3008 5870.tmp 3716 58FD.tmp 2096 598A.tmp 5020 5A26.tmp 4640 5A93.tmp 5100 5B30.tmp 1852 5BAD.tmp 1368 5C49.tmp 4092 5CF5.tmp 1200 5D91.tmp 4452 5E2D.tmp 2372 5E9B.tmp 376 5F27.tmp 2584 5FB4.tmp 3340 6040.tmp 632 60AE.tmp 2856 614A.tmp 5116 61C7.tmp 1384 6254.tmp 4928 62C1.tmp 1232 634E.tmp 536 63DA.tmp 4468 6438.tmp 4832 64B5.tmp 5088 6503.tmp 3872 6551.tmp 3436 65AF.tmp 3092 660D.tmp 1248 667A.tmp 2124 66F7.tmp 4536 6774.tmp 4424 67D2.tmp 2392 683F.tmp 5000 688D.tmp 3524 690A.tmp 5104 6978.tmp 2696 69C6.tmp 1984 6A33.tmp 4632 6A72.tmp 4360 6AC0.tmp 4328 6B0E.tmp 1392 6B4D.tmp 2664 6BAA.tmp 4024 6BF8.tmp 3320 6C47.tmp 4892 6C95.tmp 4980 6CE3.tmp 2400 6D31.tmp 768 6D7F.tmp 2332 6DCD.tmp 2752 6E1B.tmp 3152 6E79.tmp 4284 6EC7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 924 wrote to memory of 1508 924 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 81 PID 924 wrote to memory of 1508 924 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 81 PID 924 wrote to memory of 1508 924 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 81 PID 1508 wrote to memory of 1876 1508 5227.tmp 82 PID 1508 wrote to memory of 1876 1508 5227.tmp 82 PID 1508 wrote to memory of 1876 1508 5227.tmp 82 PID 1876 wrote to memory of 816 1876 52A4.tmp 83 PID 1876 wrote to memory of 816 1876 52A4.tmp 83 PID 1876 wrote to memory of 816 1876 52A4.tmp 83 PID 816 wrote to memory of 4856 816 5340.tmp 84 PID 816 wrote to memory of 4856 816 5340.tmp 84 PID 816 wrote to memory of 4856 816 5340.tmp 84 PID 4856 wrote to memory of 780 4856 53FC.tmp 85 PID 4856 wrote to memory of 780 4856 53FC.tmp 85 PID 4856 wrote to memory of 780 4856 53FC.tmp 85 PID 780 wrote to memory of 4376 780 5498.tmp 86 PID 780 wrote to memory of 4376 780 5498.tmp 86 PID 780 wrote to memory of 4376 780 5498.tmp 86 PID 4376 wrote to memory of 4124 4376 5544.tmp 87 PID 4376 wrote to memory of 4124 4376 5544.tmp 87 PID 4376 wrote to memory of 4124 4376 5544.tmp 87 PID 4124 wrote to memory of 4284 4124 55B1.tmp 88 PID 4124 wrote to memory of 4284 4124 55B1.tmp 88 PID 4124 wrote to memory of 4284 4124 55B1.tmp 88 PID 4284 wrote to memory of 2396 4284 561F.tmp 89 PID 4284 wrote to memory of 2396 4284 561F.tmp 89 PID 4284 wrote to memory of 2396 4284 561F.tmp 89 PID 2396 wrote to memory of 3648 2396 56AB.tmp 90 PID 2396 wrote to memory of 3648 2396 56AB.tmp 90 PID 2396 wrote to memory of 3648 2396 56AB.tmp 90 PID 3648 wrote to memory of 3492 3648 5748.tmp 91 PID 3648 wrote to memory of 3492 3648 5748.tmp 91 PID 3648 wrote to memory of 3492 3648 5748.tmp 91 PID 3492 wrote to memory of 3008 3492 57B5.tmp 92 PID 3492 wrote to memory of 3008 3492 57B5.tmp 92 PID 3492 wrote to memory of 3008 3492 57B5.tmp 92 PID 3008 wrote to memory of 3716 3008 5870.tmp 93 PID 3008 wrote to memory of 3716 3008 5870.tmp 93 PID 3008 wrote to memory of 3716 3008 5870.tmp 93 PID 3716 wrote to memory of 2096 3716 58FD.tmp 94 PID 3716 wrote to memory of 2096 3716 58FD.tmp 94 PID 3716 wrote to memory of 2096 3716 58FD.tmp 94 PID 2096 wrote to memory of 5020 2096 598A.tmp 95 PID 2096 wrote to memory of 5020 2096 598A.tmp 95 PID 2096 wrote to memory of 5020 2096 598A.tmp 95 PID 5020 wrote to memory of 4640 5020 5A26.tmp 96 PID 5020 wrote to memory of 4640 5020 5A26.tmp 96 PID 5020 wrote to memory of 4640 5020 5A26.tmp 96 PID 4640 wrote to memory of 5100 4640 5A93.tmp 97 PID 4640 wrote to memory of 5100 4640 5A93.tmp 97 PID 4640 wrote to memory of 5100 4640 5A93.tmp 97 PID 5100 wrote to memory of 1852 5100 5B30.tmp 98 PID 5100 wrote to memory of 1852 5100 5B30.tmp 98 PID 5100 wrote to memory of 1852 5100 5B30.tmp 98 PID 1852 wrote to memory of 1368 1852 5BAD.tmp 99 PID 1852 wrote to memory of 1368 1852 5BAD.tmp 99 PID 1852 wrote to memory of 1368 1852 5BAD.tmp 99 PID 1368 wrote to memory of 4092 1368 5C49.tmp 100 PID 1368 wrote to memory of 4092 1368 5C49.tmp 100 PID 1368 wrote to memory of 4092 1368 5C49.tmp 100 PID 4092 wrote to memory of 1200 4092 5CF5.tmp 101 PID 4092 wrote to memory of 1200 4092 5CF5.tmp 101 PID 4092 wrote to memory of 1200 4092 5CF5.tmp 101 PID 1200 wrote to memory of 4452 1200 5D91.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"23⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"24⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"25⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"26⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"27⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"28⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"29⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"30⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"31⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"32⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"33⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"34⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"35⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"36⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"37⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"38⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"39⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"40⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"41⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"42⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"43⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"44⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"45⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"46⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"47⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"48⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"49⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"50⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"51⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"52⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"53⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"54⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"55⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"56⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"57⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"58⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"59⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"60⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"61⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"62⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"63⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"64⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"65⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"66⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"67⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"68⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"69⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"70⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"71⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"72⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"73⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"74⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"75⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"76⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"77⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"78⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"79⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"80⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"81⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"82⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"83⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"84⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"85⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"87⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"88⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"89⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"90⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"91⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"92⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"93⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"94⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"95⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"96⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"97⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"98⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"99⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"100⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"101⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"102⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"103⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"104⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"105⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"106⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"107⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"108⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"109⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"110⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"111⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"112⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"113⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"114⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"116⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"117⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"118⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"119⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"120⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"121⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"122⤵PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-