Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe
-
Size
488KB
-
MD5
43a99efb8c0a2664e07d99746fbee16b
-
SHA1
00f7dd8fd25f95a9b780e620e0c5e6779d07da8a
-
SHA256
bf3cac834b013ec1544a7cbfaef0e2bc1ca4afd13b8f6e660352a616965d8d94
-
SHA512
1977b6817a2d426f7eed810781080a95da78332e5d64c67a00e07da929a126558157461f6a42bba8d445ad84c40db7ba8bbd67aea6962280cd7444df83e18033
-
SSDEEP
12288:/U5rCOTeiD8xWthpxqf7oM1GUyM0V4zi2t+Su6NZ:/UQOJD8Qhpxqf7oYXoD4vN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 824 46CD.tmp 3016 472B.tmp 3816 47A8.tmp 5100 4825.tmp 1076 4892.tmp 4592 491F.tmp 2232 498C.tmp 1204 49DA.tmp 4284 4A47.tmp 1948 4AA5.tmp 2212 4B13.tmp 2028 4B70.tmp 3820 4BDE.tmp 980 4C2C.tmp 2020 4C8A.tmp 5008 4CD8.tmp 4012 4D35.tmp 1928 4D93.tmp 1920 4E01.tmp 4468 4E6E.tmp 3208 4EDB.tmp 4540 4F49.tmp 1036 4FA6.tmp 3204 4FF5.tmp 3392 5052.tmp 3596 50C0.tmp 4912 511D.tmp 4600 518B.tmp 4588 51D9.tmp 5016 5237.tmp 3380 52A4.tmp 2244 5321.tmp 2776 537F.tmp 1612 53DD.tmp 448 542B.tmp 2904 5488.tmp 1704 54D7.tmp 548 5525.tmp 4520 5573.tmp 4404 55C1.tmp 1936 560F.tmp 1472 565D.tmp 4228 56AB.tmp 3452 56F9.tmp 4932 5757.tmp 4864 57A5.tmp 2976 57E4.tmp 3280 5842.tmp 3384 589F.tmp 876 58ED.tmp 4872 593C.tmp 4936 598A.tmp 1564 59D8.tmp 3348 5A26.tmp 4944 5A74.tmp 4356 5AD2.tmp 5088 5B20.tmp 3676 5B6E.tmp 4472 5BCC.tmp 4456 5C1A.tmp 1576 5C68.tmp 972 5CC6.tmp 4376 5D24.tmp 4048 5D81.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 824 1576 2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe 85 PID 1576 wrote to memory of 824 1576 2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe 85 PID 1576 wrote to memory of 824 1576 2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe 85 PID 824 wrote to memory of 3016 824 46CD.tmp 86 PID 824 wrote to memory of 3016 824 46CD.tmp 86 PID 824 wrote to memory of 3016 824 46CD.tmp 86 PID 3016 wrote to memory of 3816 3016 472B.tmp 87 PID 3016 wrote to memory of 3816 3016 472B.tmp 87 PID 3016 wrote to memory of 3816 3016 472B.tmp 87 PID 3816 wrote to memory of 5100 3816 47A8.tmp 88 PID 3816 wrote to memory of 5100 3816 47A8.tmp 88 PID 3816 wrote to memory of 5100 3816 47A8.tmp 88 PID 5100 wrote to memory of 1076 5100 4825.tmp 89 PID 5100 wrote to memory of 1076 5100 4825.tmp 89 PID 5100 wrote to memory of 1076 5100 4825.tmp 89 PID 1076 wrote to memory of 4592 1076 4892.tmp 90 PID 1076 wrote to memory of 4592 1076 4892.tmp 90 PID 1076 wrote to memory of 4592 1076 4892.tmp 90 PID 4592 wrote to memory of 2232 4592 491F.tmp 91 PID 4592 wrote to memory of 2232 4592 491F.tmp 91 PID 4592 wrote to memory of 2232 4592 491F.tmp 91 PID 2232 wrote to memory of 1204 2232 498C.tmp 92 PID 2232 wrote to memory of 1204 2232 498C.tmp 92 PID 2232 wrote to memory of 1204 2232 498C.tmp 92 PID 1204 wrote to memory of 4284 1204 49DA.tmp 93 PID 1204 wrote to memory of 4284 1204 49DA.tmp 93 PID 1204 wrote to memory of 4284 1204 49DA.tmp 93 PID 4284 wrote to memory of 1948 4284 4A47.tmp 94 PID 4284 wrote to memory of 1948 4284 4A47.tmp 94 PID 4284 wrote to memory of 1948 4284 4A47.tmp 94 PID 1948 wrote to memory of 2212 1948 4AA5.tmp 95 PID 1948 wrote to memory of 2212 1948 4AA5.tmp 95 PID 1948 wrote to memory of 2212 1948 4AA5.tmp 95 PID 2212 wrote to memory of 2028 2212 4B13.tmp 96 PID 2212 wrote to memory of 2028 2212 4B13.tmp 96 PID 2212 wrote to memory of 2028 2212 4B13.tmp 96 PID 2028 wrote to memory of 3820 2028 4B70.tmp 97 PID 2028 wrote to memory of 3820 2028 4B70.tmp 97 PID 2028 wrote to memory of 3820 2028 4B70.tmp 97 PID 3820 wrote to memory of 980 3820 4BDE.tmp 98 PID 3820 wrote to memory of 980 3820 4BDE.tmp 98 PID 3820 wrote to memory of 980 3820 4BDE.tmp 98 PID 980 wrote to memory of 2020 980 4C2C.tmp 99 PID 980 wrote to memory of 2020 980 4C2C.tmp 99 PID 980 wrote to memory of 2020 980 4C2C.tmp 99 PID 2020 wrote to memory of 5008 2020 4C8A.tmp 100 PID 2020 wrote to memory of 5008 2020 4C8A.tmp 100 PID 2020 wrote to memory of 5008 2020 4C8A.tmp 100 PID 5008 wrote to memory of 4012 5008 4CD8.tmp 101 PID 5008 wrote to memory of 4012 5008 4CD8.tmp 101 PID 5008 wrote to memory of 4012 5008 4CD8.tmp 101 PID 4012 wrote to memory of 1928 4012 4D35.tmp 102 PID 4012 wrote to memory of 1928 4012 4D35.tmp 102 PID 4012 wrote to memory of 1928 4012 4D35.tmp 102 PID 1928 wrote to memory of 1920 1928 4D93.tmp 103 PID 1928 wrote to memory of 1920 1928 4D93.tmp 103 PID 1928 wrote to memory of 1920 1928 4D93.tmp 103 PID 1920 wrote to memory of 4468 1920 4E01.tmp 104 PID 1920 wrote to memory of 4468 1920 4E01.tmp 104 PID 1920 wrote to memory of 4468 1920 4E01.tmp 104 PID 4468 wrote to memory of 3208 4468 4E6E.tmp 105 PID 4468 wrote to memory of 3208 4468 4E6E.tmp 105 PID 4468 wrote to memory of 3208 4468 4E6E.tmp 105 PID 3208 wrote to memory of 4540 3208 4EDB.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_43a99efb8c0a2664e07d99746fbee16b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"23⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"24⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"25⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"26⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"27⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"28⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"29⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"30⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"32⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"33⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"34⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"35⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"36⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"37⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"38⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"39⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"40⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"41⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"42⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"43⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"44⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"45⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"46⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"47⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"48⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"49⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"50⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"51⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"52⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"53⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"54⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"55⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"56⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"57⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"58⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"59⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"60⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"61⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"62⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"63⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"64⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"65⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"66⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"67⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"68⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"69⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"70⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"71⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"72⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"73⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"74⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"75⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"76⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"77⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"78⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"79⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"80⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"81⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"83⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"84⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"85⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"86⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"87⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"88⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"89⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"90⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"91⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"92⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"93⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"94⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"95⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"96⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"97⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"98⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"99⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"100⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"101⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"102⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"103⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"104⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"105⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"106⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"107⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"108⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"109⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"110⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"111⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"112⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"113⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"114⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"115⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"117⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"118⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"119⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"120⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"121⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"122⤵PID:3528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-