Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe
-
Size
530KB
-
MD5
693c6db8f9fcba36ad5a25fa5f115b5e
-
SHA1
da9d1f98fa5b6043df0b357d0ac3e962b8223da4
-
SHA256
dee68e88afd9742333d6319fc87c68d78087e608bc9fec1e0349dd9b6fc59147
-
SHA512
7e89c98748ffbecd05a172ee6f4d556b06fbd183572ab9b9bc40e4d84cc9e23d3aaeb7971be117d0c82685cd54ec64aa8e80641fbe5824a2bfbe97e6c3783a16
-
SSDEEP
12288:AU5rCOTeio4/1gEif9UfNhMyz2ciFhZvwbCMDAhENZulFVg0M1:AUQOJo4/1gbwhMyz2GDA+NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2732 467F.tmp 4480 474A.tmp 4500 47B7.tmp 4020 4853.tmp 3212 48FF.tmp 3916 498C.tmp 2972 4A09.tmp 4812 4A96.tmp 812 4B32.tmp 4244 4B9F.tmp 940 4C2C.tmp 1016 4CA9.tmp 4764 4D26.tmp 4616 4D93.tmp 2868 4E20.tmp 5020 4E9D.tmp 3668 4F1A.tmp 2548 4F97.tmp 4284 5004.tmp 5028 5072.tmp 1380 50DF.tmp 3752 512D.tmp 2504 51BA.tmp 4580 5227.tmp 2404 5285.tmp 3240 52F2.tmp 4920 536F.tmp 1192 53CD.tmp 1812 545A.tmp 3204 5505.tmp 5112 5573.tmp 3396 55FF.tmp 3588 567C.tmp 2392 56DA.tmp 4232 5728.tmp 4388 5776.tmp 3880 57D4.tmp 3336 5822.tmp 4860 5890.tmp 2284 58ED.tmp 3920 594B.tmp 2064 59A9.tmp 2844 59F7.tmp 1372 5A64.tmp 4760 5AB3.tmp 2608 5B10.tmp 452 5B5E.tmp 2388 5BCC.tmp 4328 5C2A.tmp 4076 5C78.tmp 3492 5CE5.tmp 4016 5D43.tmp 4320 5DB0.tmp 3216 5DFE.tmp 3184 5E4C.tmp 4500 5EBA.tmp 5096 5F08.tmp 4584 5F66.tmp 2436 5FC3.tmp 4208 6012.tmp 4756 607F.tmp 1052 60DD.tmp 1516 613A.tmp 3488 6198.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2732 1496 2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe 82 PID 1496 wrote to memory of 2732 1496 2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe 82 PID 1496 wrote to memory of 2732 1496 2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe 82 PID 2732 wrote to memory of 4480 2732 467F.tmp 84 PID 2732 wrote to memory of 4480 2732 467F.tmp 84 PID 2732 wrote to memory of 4480 2732 467F.tmp 84 PID 4480 wrote to memory of 4500 4480 474A.tmp 85 PID 4480 wrote to memory of 4500 4480 474A.tmp 85 PID 4480 wrote to memory of 4500 4480 474A.tmp 85 PID 4500 wrote to memory of 4020 4500 47B7.tmp 87 PID 4500 wrote to memory of 4020 4500 47B7.tmp 87 PID 4500 wrote to memory of 4020 4500 47B7.tmp 87 PID 4020 wrote to memory of 3212 4020 4853.tmp 88 PID 4020 wrote to memory of 3212 4020 4853.tmp 88 PID 4020 wrote to memory of 3212 4020 4853.tmp 88 PID 3212 wrote to memory of 3916 3212 48FF.tmp 90 PID 3212 wrote to memory of 3916 3212 48FF.tmp 90 PID 3212 wrote to memory of 3916 3212 48FF.tmp 90 PID 3916 wrote to memory of 2972 3916 498C.tmp 91 PID 3916 wrote to memory of 2972 3916 498C.tmp 91 PID 3916 wrote to memory of 2972 3916 498C.tmp 91 PID 2972 wrote to memory of 4812 2972 4A09.tmp 92 PID 2972 wrote to memory of 4812 2972 4A09.tmp 92 PID 2972 wrote to memory of 4812 2972 4A09.tmp 92 PID 4812 wrote to memory of 812 4812 4A96.tmp 93 PID 4812 wrote to memory of 812 4812 4A96.tmp 93 PID 4812 wrote to memory of 812 4812 4A96.tmp 93 PID 812 wrote to memory of 4244 812 4B32.tmp 94 PID 812 wrote to memory of 4244 812 4B32.tmp 94 PID 812 wrote to memory of 4244 812 4B32.tmp 94 PID 4244 wrote to memory of 940 4244 4B9F.tmp 95 PID 4244 wrote to memory of 940 4244 4B9F.tmp 95 PID 4244 wrote to memory of 940 4244 4B9F.tmp 95 PID 940 wrote to memory of 1016 940 4C2C.tmp 96 PID 940 wrote to memory of 1016 940 4C2C.tmp 96 PID 940 wrote to memory of 1016 940 4C2C.tmp 96 PID 1016 wrote to memory of 4764 1016 4CA9.tmp 97 PID 1016 wrote to memory of 4764 1016 4CA9.tmp 97 PID 1016 wrote to memory of 4764 1016 4CA9.tmp 97 PID 4764 wrote to memory of 4616 4764 4D26.tmp 98 PID 4764 wrote to memory of 4616 4764 4D26.tmp 98 PID 4764 wrote to memory of 4616 4764 4D26.tmp 98 PID 4616 wrote to memory of 2868 4616 4D93.tmp 99 PID 4616 wrote to memory of 2868 4616 4D93.tmp 99 PID 4616 wrote to memory of 2868 4616 4D93.tmp 99 PID 2868 wrote to memory of 5020 2868 4E20.tmp 100 PID 2868 wrote to memory of 5020 2868 4E20.tmp 100 PID 2868 wrote to memory of 5020 2868 4E20.tmp 100 PID 5020 wrote to memory of 3668 5020 4E9D.tmp 101 PID 5020 wrote to memory of 3668 5020 4E9D.tmp 101 PID 5020 wrote to memory of 3668 5020 4E9D.tmp 101 PID 3668 wrote to memory of 2548 3668 4F1A.tmp 102 PID 3668 wrote to memory of 2548 3668 4F1A.tmp 102 PID 3668 wrote to memory of 2548 3668 4F1A.tmp 102 PID 2548 wrote to memory of 4284 2548 4F97.tmp 103 PID 2548 wrote to memory of 4284 2548 4F97.tmp 103 PID 2548 wrote to memory of 4284 2548 4F97.tmp 103 PID 4284 wrote to memory of 5028 4284 5004.tmp 104 PID 4284 wrote to memory of 5028 4284 5004.tmp 104 PID 4284 wrote to memory of 5028 4284 5004.tmp 104 PID 5028 wrote to memory of 1380 5028 5072.tmp 105 PID 5028 wrote to memory of 1380 5028 5072.tmp 105 PID 5028 wrote to memory of 1380 5028 5072.tmp 105 PID 1380 wrote to memory of 3752 1380 50DF.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_693c6db8f9fcba36ad5a25fa5f115b5e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"23⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"24⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"25⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"26⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"27⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"28⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"29⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"30⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"31⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"32⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"33⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"34⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"35⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"36⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"37⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"38⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"39⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"40⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"41⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"42⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"43⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"44⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"45⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"46⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"47⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"48⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"49⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"50⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"51⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"52⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"53⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"54⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"55⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"56⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"57⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"58⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"59⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"60⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"61⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"62⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"63⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"64⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"65⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"67⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"69⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"70⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"71⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"72⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"73⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"74⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"75⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"76⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"77⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"78⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"79⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"80⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"82⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"83⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"85⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"86⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"87⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"88⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"89⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"90⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"91⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"92⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"93⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"94⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"95⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"96⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"97⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"98⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"99⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"100⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"101⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"102⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"103⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"104⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"105⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"106⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"107⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"108⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"109⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"110⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"111⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"112⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"113⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"114⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"115⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"116⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"117⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"118⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"119⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"120⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-