Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe
-
Size
520KB
-
MD5
9cf8db627d909eb4cd13e365ba61b3ec
-
SHA1
7c3eff86a26c8e98081e97901fc2d046025b2c3d
-
SHA256
0b42bc3f28f8a9d57b3b5538c7036365907621b0b1317028e783f01af488bd24
-
SHA512
cb6bfd3cbcd8215d02d78072f93b8b763f05e94b63ed11d93fa657bd64d79b4abd582145c418c42c02bcee36547fb70c1b093f380145a86ed508d6f6c4e08ac0
-
SSDEEP
12288:gj8fuxR21t5i8fqocD7w8bJDylnwGHYw1UENZ:gj8fuK1GYhcvw8bJDylnRHY0BN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3388 56F9.tmp 1736 5757.tmp 1636 57D4.tmp 4612 5851.tmp 4488 58CE.tmp 2164 595B.tmp 4308 59E7.tmp 1176 5A45.tmp 3412 5AD2.tmp 3256 5B20.tmp 3084 5B7E.tmp 2924 5BDB.tmp 4172 5C58.tmp 2912 5CA7.tmp 3608 5CF5.tmp 1524 5D72.tmp 4468 5DDF.tmp 4168 5E2D.tmp 2180 5E8B.tmp 3512 5EF8.tmp 3240 5F75.tmp 1692 5FC3.tmp 1872 6021.tmp 3496 607F.tmp 3680 610C.tmp 5076 6189.tmp 4524 61E6.tmp 2724 6254.tmp 2264 62A2.tmp 548 630F.tmp 1404 638C.tmp 4680 63EA.tmp 1512 6467.tmp 4024 64C5.tmp 2936 6513.tmp 3220 6571.tmp 2592 65BF.tmp 1536 661C.tmp 1056 667A.tmp 2856 66C8.tmp 4108 6726.tmp 2412 6774.tmp 3228 67D2.tmp 2256 6820.tmp 3448 686E.tmp 4356 68CC.tmp 696 691A.tmp 3696 6968.tmp 3764 69B6.tmp 4284 6A04.tmp 3644 6A62.tmp 2596 6AC0.tmp 1812 6B1E.tmp 2432 6B6C.tmp 4796 6BBA.tmp 4604 6C18.tmp 1464 6C66.tmp 2016 6CB4.tmp 2228 6D02.tmp 2452 6D50.tmp 1508 6DAE.tmp 1048 6E0C.tmp 532 6E5A.tmp 4988 6EB8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 3388 1756 2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe 81 PID 1756 wrote to memory of 3388 1756 2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe 81 PID 1756 wrote to memory of 3388 1756 2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe 81 PID 3388 wrote to memory of 1736 3388 56F9.tmp 82 PID 3388 wrote to memory of 1736 3388 56F9.tmp 82 PID 3388 wrote to memory of 1736 3388 56F9.tmp 82 PID 1736 wrote to memory of 1636 1736 5757.tmp 83 PID 1736 wrote to memory of 1636 1736 5757.tmp 83 PID 1736 wrote to memory of 1636 1736 5757.tmp 83 PID 1636 wrote to memory of 4612 1636 57D4.tmp 84 PID 1636 wrote to memory of 4612 1636 57D4.tmp 84 PID 1636 wrote to memory of 4612 1636 57D4.tmp 84 PID 4612 wrote to memory of 4488 4612 5851.tmp 85 PID 4612 wrote to memory of 4488 4612 5851.tmp 85 PID 4612 wrote to memory of 4488 4612 5851.tmp 85 PID 4488 wrote to memory of 2164 4488 58CE.tmp 86 PID 4488 wrote to memory of 2164 4488 58CE.tmp 86 PID 4488 wrote to memory of 2164 4488 58CE.tmp 86 PID 2164 wrote to memory of 4308 2164 595B.tmp 87 PID 2164 wrote to memory of 4308 2164 595B.tmp 87 PID 2164 wrote to memory of 4308 2164 595B.tmp 87 PID 4308 wrote to memory of 1176 4308 59E7.tmp 88 PID 4308 wrote to memory of 1176 4308 59E7.tmp 88 PID 4308 wrote to memory of 1176 4308 59E7.tmp 88 PID 1176 wrote to memory of 3412 1176 5A45.tmp 89 PID 1176 wrote to memory of 3412 1176 5A45.tmp 89 PID 1176 wrote to memory of 3412 1176 5A45.tmp 89 PID 3412 wrote to memory of 3256 3412 5AD2.tmp 90 PID 3412 wrote to memory of 3256 3412 5AD2.tmp 90 PID 3412 wrote to memory of 3256 3412 5AD2.tmp 90 PID 3256 wrote to memory of 3084 3256 5B20.tmp 91 PID 3256 wrote to memory of 3084 3256 5B20.tmp 91 PID 3256 wrote to memory of 3084 3256 5B20.tmp 91 PID 3084 wrote to memory of 2924 3084 5B7E.tmp 92 PID 3084 wrote to memory of 2924 3084 5B7E.tmp 92 PID 3084 wrote to memory of 2924 3084 5B7E.tmp 92 PID 2924 wrote to memory of 4172 2924 5BDB.tmp 93 PID 2924 wrote to memory of 4172 2924 5BDB.tmp 93 PID 2924 wrote to memory of 4172 2924 5BDB.tmp 93 PID 4172 wrote to memory of 2912 4172 5C58.tmp 94 PID 4172 wrote to memory of 2912 4172 5C58.tmp 94 PID 4172 wrote to memory of 2912 4172 5C58.tmp 94 PID 2912 wrote to memory of 3608 2912 5CA7.tmp 95 PID 2912 wrote to memory of 3608 2912 5CA7.tmp 95 PID 2912 wrote to memory of 3608 2912 5CA7.tmp 95 PID 3608 wrote to memory of 1524 3608 5CF5.tmp 96 PID 3608 wrote to memory of 1524 3608 5CF5.tmp 96 PID 3608 wrote to memory of 1524 3608 5CF5.tmp 96 PID 1524 wrote to memory of 4468 1524 5D72.tmp 97 PID 1524 wrote to memory of 4468 1524 5D72.tmp 97 PID 1524 wrote to memory of 4468 1524 5D72.tmp 97 PID 4468 wrote to memory of 4168 4468 5DDF.tmp 98 PID 4468 wrote to memory of 4168 4468 5DDF.tmp 98 PID 4468 wrote to memory of 4168 4468 5DDF.tmp 98 PID 4168 wrote to memory of 2180 4168 5E2D.tmp 99 PID 4168 wrote to memory of 2180 4168 5E2D.tmp 99 PID 4168 wrote to memory of 2180 4168 5E2D.tmp 99 PID 2180 wrote to memory of 3512 2180 5E8B.tmp 100 PID 2180 wrote to memory of 3512 2180 5E8B.tmp 100 PID 2180 wrote to memory of 3512 2180 5E8B.tmp 100 PID 3512 wrote to memory of 3240 3512 5EF8.tmp 101 PID 3512 wrote to memory of 3240 3512 5EF8.tmp 101 PID 3512 wrote to memory of 3240 3512 5EF8.tmp 101 PID 3240 wrote to memory of 1692 3240 5F75.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_9cf8db627d909eb4cd13e365ba61b3ec_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"23⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"24⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"25⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"26⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"27⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"28⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"29⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"30⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"31⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"32⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"33⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"34⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"35⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"36⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"37⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"38⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"39⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"40⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"41⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"42⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"43⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"44⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"45⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"46⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"47⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"48⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"49⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"50⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"51⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"52⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"53⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"54⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"55⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"56⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"57⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"58⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"59⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"60⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"61⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"62⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"63⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"64⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"65⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"66⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"67⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"68⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"69⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"70⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"71⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"72⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"73⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"74⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"75⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"76⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"77⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"78⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"79⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"80⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"81⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"82⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"83⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"85⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"86⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"87⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"88⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"89⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"90⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"91⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"92⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"93⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"94⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"95⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"96⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"97⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"98⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"99⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"100⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"101⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"102⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"103⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"104⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"105⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"106⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"107⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"108⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"109⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"110⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"111⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"112⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"113⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"114⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"115⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"116⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"117⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"118⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"119⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"120⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"121⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"122⤵PID:3636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-