Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 11:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
-
Size
486KB
-
MD5
4f85b9d117e9cda504ade61af990da9a
-
SHA1
4b1c46734816d27544142f0331e4d1a1fecb8230
-
SHA256
66e899ab65b9e18bd7bee994d8f9ee7c8463f91f32de7a0aff8896215b012096
-
SHA512
a3d2cb8fd6137329401f9b6fbcba119b1032e1c65259ff6cd30bbefa00eea86f2aa7e6eaabaf6509560f3175b2832265dcc074f20fbc8d0a719a5207ef4712a0
-
SSDEEP
12288:/U5rCOTeiDaTOq/4dQRmds4XiZw7bUY8NZ:/UQOJDapwdQRm+4XiZw7oLN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1072 4B51.tmp 2288 4BBE.tmp 2264 4C2C.tmp 4996 4C8A.tmp 4660 4D16.tmp 5080 4D64.tmp 4536 4DC2.tmp 4824 4E10.tmp 2036 4E6E.tmp 588 4EDB.tmp 3452 4F39.tmp 2336 4FA6.tmp 2168 5004.tmp 2052 5081.tmp 2240 50CF.tmp 3148 512D.tmp 4772 519A.tmp 4764 51F8.tmp 2360 5256.tmp 5076 52A4.tmp 5096 5321.tmp 3708 537F.tmp 1496 53FC.tmp 2284 5488.tmp 4672 54E6.tmp 532 5563.tmp 3492 55B1.tmp 4224 562E.tmp 888 567C.tmp 1276 56CB.tmp 4500 5728.tmp 1504 5796.tmp 760 5803.tmp 1748 5851.tmp 4252 589F.tmp 2952 58ED.tmp 4272 594B.tmp 388 59C8.tmp 4464 5A26.tmp 2452 5A74.tmp 2520 5AD2.tmp 3736 5B20.tmp 4424 5B6E.tmp 1764 5BBC.tmp 2784 5C0A.tmp 3164 5C58.tmp 1624 5CA7.tmp 2444 5D04.tmp 1800 5D62.tmp 668 5DB0.tmp 2816 5DEF.tmp 2228 5E3D.tmp 1472 5EAA.tmp 3348 5EF8.tmp 1160 5F46.tmp 1604 5FA4.tmp 4932 5FF2.tmp 1372 6040.tmp 3804 608F.tmp 1072 60DD.tmp 4060 612B.tmp 3748 6179.tmp 2264 61C7.tmp 4640 6225.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 1072 4112 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 84 PID 4112 wrote to memory of 1072 4112 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 84 PID 4112 wrote to memory of 1072 4112 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 84 PID 1072 wrote to memory of 2288 1072 4B51.tmp 85 PID 1072 wrote to memory of 2288 1072 4B51.tmp 85 PID 1072 wrote to memory of 2288 1072 4B51.tmp 85 PID 2288 wrote to memory of 2264 2288 4BBE.tmp 86 PID 2288 wrote to memory of 2264 2288 4BBE.tmp 86 PID 2288 wrote to memory of 2264 2288 4BBE.tmp 86 PID 2264 wrote to memory of 4996 2264 4C2C.tmp 87 PID 2264 wrote to memory of 4996 2264 4C2C.tmp 87 PID 2264 wrote to memory of 4996 2264 4C2C.tmp 87 PID 4996 wrote to memory of 4660 4996 4C8A.tmp 88 PID 4996 wrote to memory of 4660 4996 4C8A.tmp 88 PID 4996 wrote to memory of 4660 4996 4C8A.tmp 88 PID 4660 wrote to memory of 5080 4660 4D16.tmp 89 PID 4660 wrote to memory of 5080 4660 4D16.tmp 89 PID 4660 wrote to memory of 5080 4660 4D16.tmp 89 PID 5080 wrote to memory of 4536 5080 4D64.tmp 90 PID 5080 wrote to memory of 4536 5080 4D64.tmp 90 PID 5080 wrote to memory of 4536 5080 4D64.tmp 90 PID 4536 wrote to memory of 4824 4536 4DC2.tmp 91 PID 4536 wrote to memory of 4824 4536 4DC2.tmp 91 PID 4536 wrote to memory of 4824 4536 4DC2.tmp 91 PID 4824 wrote to memory of 2036 4824 4E10.tmp 92 PID 4824 wrote to memory of 2036 4824 4E10.tmp 92 PID 4824 wrote to memory of 2036 4824 4E10.tmp 92 PID 2036 wrote to memory of 588 2036 4E6E.tmp 93 PID 2036 wrote to memory of 588 2036 4E6E.tmp 93 PID 2036 wrote to memory of 588 2036 4E6E.tmp 93 PID 588 wrote to memory of 3452 588 4EDB.tmp 94 PID 588 wrote to memory of 3452 588 4EDB.tmp 94 PID 588 wrote to memory of 3452 588 4EDB.tmp 94 PID 3452 wrote to memory of 2336 3452 4F39.tmp 95 PID 3452 wrote to memory of 2336 3452 4F39.tmp 95 PID 3452 wrote to memory of 2336 3452 4F39.tmp 95 PID 2336 wrote to memory of 2168 2336 4FA6.tmp 96 PID 2336 wrote to memory of 2168 2336 4FA6.tmp 96 PID 2336 wrote to memory of 2168 2336 4FA6.tmp 96 PID 2168 wrote to memory of 2052 2168 5004.tmp 97 PID 2168 wrote to memory of 2052 2168 5004.tmp 97 PID 2168 wrote to memory of 2052 2168 5004.tmp 97 PID 2052 wrote to memory of 2240 2052 5081.tmp 98 PID 2052 wrote to memory of 2240 2052 5081.tmp 98 PID 2052 wrote to memory of 2240 2052 5081.tmp 98 PID 2240 wrote to memory of 3148 2240 50CF.tmp 99 PID 2240 wrote to memory of 3148 2240 50CF.tmp 99 PID 2240 wrote to memory of 3148 2240 50CF.tmp 99 PID 3148 wrote to memory of 4772 3148 512D.tmp 100 PID 3148 wrote to memory of 4772 3148 512D.tmp 100 PID 3148 wrote to memory of 4772 3148 512D.tmp 100 PID 4772 wrote to memory of 4764 4772 519A.tmp 101 PID 4772 wrote to memory of 4764 4772 519A.tmp 101 PID 4772 wrote to memory of 4764 4772 519A.tmp 101 PID 4764 wrote to memory of 2360 4764 51F8.tmp 102 PID 4764 wrote to memory of 2360 4764 51F8.tmp 102 PID 4764 wrote to memory of 2360 4764 51F8.tmp 102 PID 2360 wrote to memory of 5076 2360 5256.tmp 103 PID 2360 wrote to memory of 5076 2360 5256.tmp 103 PID 2360 wrote to memory of 5076 2360 5256.tmp 103 PID 5076 wrote to memory of 5096 5076 52A4.tmp 104 PID 5076 wrote to memory of 5096 5076 52A4.tmp 104 PID 5076 wrote to memory of 5096 5076 52A4.tmp 104 PID 5096 wrote to memory of 3708 5096 5321.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"23⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"24⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"25⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"26⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"27⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"28⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"29⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"30⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"31⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"32⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"33⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"34⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"35⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"36⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"37⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"38⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"39⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"40⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"41⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"42⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"43⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"44⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"45⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"46⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"47⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"48⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"49⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"50⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"51⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"52⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"53⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"54⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"55⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"56⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"57⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"58⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"59⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"60⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"61⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"62⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"63⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"64⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"65⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"66⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"67⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"68⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"69⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"70⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"71⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"72⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"73⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"74⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"75⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"76⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"77⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"78⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"79⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"80⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"81⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"82⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"83⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"84⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"85⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"86⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"87⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"88⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"89⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"90⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"91⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"92⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"93⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"94⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"95⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"96⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"97⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"98⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"99⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"100⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"101⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"103⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"104⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"105⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"106⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"107⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"108⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"109⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"110⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"111⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"112⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"113⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"114⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"115⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"116⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"117⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"118⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"119⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"120⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"121⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"122⤵PID:652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-