Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe
-
Size
486KB
-
MD5
816d1d399ef6cd337333fdf9efef2c36
-
SHA1
3dc6e5c3a44d8a0b31dcf87f5360b051cb605db5
-
SHA256
9afa85a79e0aa7ea9efaa0a0e53638d40c142bf6f4a44230aae5e1233436f21b
-
SHA512
99b398a4e7764fd6be5b6739ce70a5b5c1b882fbdb2388774e308367c903940765ca27dbdc7013f29ce76ec9376cc489ae238dc6da4a23d7cdda7ac768198a45
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7gwlrW6trbjhN5COs61It/bf1hz73G7y6ZogF:/U5rCOTeiDgSnn5XZ1ItTD7n2AgNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3112 4527.tmp 520 45B4.tmp 3992 4621.tmp 1460 469E.tmp 2180 471B.tmp 1080 4798.tmp 4416 47F6.tmp 2524 4844.tmp 1540 48A2.tmp 1348 48F0.tmp 2852 494D.tmp 1076 499C.tmp 1456 49EA.tmp 2616 4A57.tmp 3624 4AC4.tmp 4572 4B22.tmp 2760 4B80.tmp 536 4BED.tmp 3124 4C5B.tmp 2464 4CB8.tmp 772 4D16.tmp 3044 4D74.tmp 4624 4DC2.tmp 4144 4E2F.tmp 3252 4EAC.tmp 3128 4F1A.tmp 4840 4F97.tmp 3536 5014.tmp 3320 5062.tmp 4780 50CF.tmp 1480 513D.tmp 1264 51BA.tmp 1228 5227.tmp 4360 5285.tmp 2228 52D3.tmp 3996 5321.tmp 1332 537F.tmp 220 53CD.tmp 3032 541B.tmp 3544 5479.tmp 4056 54C7.tmp 684 5525.tmp 4284 5582.tmp 744 55D1.tmp 2832 562E.tmp 3756 567C.tmp 2324 56CB.tmp 3948 5728.tmp 4148 5776.tmp 1512 57C5.tmp 5036 5813.tmp 3328 5861.tmp 4372 58BF.tmp 3308 591C.tmp 3988 596A.tmp 2148 59B9.tmp 1032 5A07.tmp 2028 5A55.tmp 2424 5AA3.tmp 4816 5AF1.tmp 2780 5B3F.tmp 4264 5B8D.tmp 3964 5BEB.tmp 1460 5C49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 3112 2016 2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe 83 PID 2016 wrote to memory of 3112 2016 2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe 83 PID 2016 wrote to memory of 3112 2016 2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe 83 PID 3112 wrote to memory of 520 3112 4527.tmp 85 PID 3112 wrote to memory of 520 3112 4527.tmp 85 PID 3112 wrote to memory of 520 3112 4527.tmp 85 PID 520 wrote to memory of 3992 520 45B4.tmp 87 PID 520 wrote to memory of 3992 520 45B4.tmp 87 PID 520 wrote to memory of 3992 520 45B4.tmp 87 PID 3992 wrote to memory of 1460 3992 4621.tmp 88 PID 3992 wrote to memory of 1460 3992 4621.tmp 88 PID 3992 wrote to memory of 1460 3992 4621.tmp 88 PID 1460 wrote to memory of 2180 1460 469E.tmp 90 PID 1460 wrote to memory of 2180 1460 469E.tmp 90 PID 1460 wrote to memory of 2180 1460 469E.tmp 90 PID 2180 wrote to memory of 1080 2180 471B.tmp 91 PID 2180 wrote to memory of 1080 2180 471B.tmp 91 PID 2180 wrote to memory of 1080 2180 471B.tmp 91 PID 1080 wrote to memory of 4416 1080 4798.tmp 92 PID 1080 wrote to memory of 4416 1080 4798.tmp 92 PID 1080 wrote to memory of 4416 1080 4798.tmp 92 PID 4416 wrote to memory of 2524 4416 47F6.tmp 93 PID 4416 wrote to memory of 2524 4416 47F6.tmp 93 PID 4416 wrote to memory of 2524 4416 47F6.tmp 93 PID 2524 wrote to memory of 1540 2524 4844.tmp 94 PID 2524 wrote to memory of 1540 2524 4844.tmp 94 PID 2524 wrote to memory of 1540 2524 4844.tmp 94 PID 1540 wrote to memory of 1348 1540 48A2.tmp 95 PID 1540 wrote to memory of 1348 1540 48A2.tmp 95 PID 1540 wrote to memory of 1348 1540 48A2.tmp 95 PID 1348 wrote to memory of 2852 1348 48F0.tmp 96 PID 1348 wrote to memory of 2852 1348 48F0.tmp 96 PID 1348 wrote to memory of 2852 1348 48F0.tmp 96 PID 2852 wrote to memory of 1076 2852 494D.tmp 97 PID 2852 wrote to memory of 1076 2852 494D.tmp 97 PID 2852 wrote to memory of 1076 2852 494D.tmp 97 PID 1076 wrote to memory of 1456 1076 499C.tmp 98 PID 1076 wrote to memory of 1456 1076 499C.tmp 98 PID 1076 wrote to memory of 1456 1076 499C.tmp 98 PID 1456 wrote to memory of 2616 1456 49EA.tmp 99 PID 1456 wrote to memory of 2616 1456 49EA.tmp 99 PID 1456 wrote to memory of 2616 1456 49EA.tmp 99 PID 2616 wrote to memory of 3624 2616 4A57.tmp 100 PID 2616 wrote to memory of 3624 2616 4A57.tmp 100 PID 2616 wrote to memory of 3624 2616 4A57.tmp 100 PID 3624 wrote to memory of 4572 3624 4AC4.tmp 101 PID 3624 wrote to memory of 4572 3624 4AC4.tmp 101 PID 3624 wrote to memory of 4572 3624 4AC4.tmp 101 PID 4572 wrote to memory of 2760 4572 4B22.tmp 102 PID 4572 wrote to memory of 2760 4572 4B22.tmp 102 PID 4572 wrote to memory of 2760 4572 4B22.tmp 102 PID 2760 wrote to memory of 536 2760 4B80.tmp 103 PID 2760 wrote to memory of 536 2760 4B80.tmp 103 PID 2760 wrote to memory of 536 2760 4B80.tmp 103 PID 536 wrote to memory of 3124 536 4BED.tmp 104 PID 536 wrote to memory of 3124 536 4BED.tmp 104 PID 536 wrote to memory of 3124 536 4BED.tmp 104 PID 3124 wrote to memory of 2464 3124 4C5B.tmp 105 PID 3124 wrote to memory of 2464 3124 4C5B.tmp 105 PID 3124 wrote to memory of 2464 3124 4C5B.tmp 105 PID 2464 wrote to memory of 772 2464 4CB8.tmp 106 PID 2464 wrote to memory of 772 2464 4CB8.tmp 106 PID 2464 wrote to memory of 772 2464 4CB8.tmp 106 PID 772 wrote to memory of 3044 772 4D16.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_816d1d399ef6cd337333fdf9efef2c36_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"23⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"24⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"25⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"26⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"27⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"28⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"29⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"30⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"31⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"32⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"33⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"34⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"35⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"36⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"37⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"38⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"39⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"40⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"41⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"42⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"43⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"44⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"45⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"46⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"47⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"48⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"49⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"50⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"51⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"52⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"53⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"54⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"55⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"56⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"57⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"58⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"59⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"60⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"61⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"62⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"63⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"64⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"65⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"66⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"67⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"68⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"69⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"70⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"72⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"73⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"74⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"75⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"76⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"77⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"78⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"79⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"80⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"81⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"82⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"83⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"84⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"85⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"86⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"87⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"88⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"89⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"90⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"91⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"92⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"93⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"94⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"95⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"97⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"98⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"99⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"100⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"101⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"102⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"103⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"104⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"105⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"106⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"107⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"108⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"109⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"110⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"111⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"112⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"113⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"114⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"115⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"116⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"117⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"118⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"119⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"120⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"121⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"122⤵PID:3308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-