Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 05:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe
-
Size
765KB
-
MD5
95eece999d11306378054550b1eacc0e
-
SHA1
640787adc99e424717789a3f4a78db77ffe38b66
-
SHA256
873e6e81f4eebab540cb09974b60ad4eee4a00d4a15242bd75a22573149fba20
-
SHA512
7fbb149f835951376bf30ac3f3de0c61f78f0c3c16dde054083bbd0fc5fde4e5402d53ab1e735ce8890a1684d5583dc03d206ab5596e564570cc508ca2a4b0de
-
SSDEEP
12288:ZU5rCOTeiDsJOcdofAJs2TZj8jQ3ZF5rn5rLOa54U5w5A:ZUQOJDsZofAJf4k3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2788 45D3.tmp 60 466F.tmp 952 46DC.tmp 3140 474A.tmp 1928 47C7.tmp 1512 4825.tmp 2016 4873.tmp 4440 48D0.tmp 4608 495D.tmp 2752 49AB.tmp 4640 4A28.tmp 924 4A86.tmp 2692 4AE4.tmp 4012 4B61.tmp 4340 4C0D.tmp 2920 4C6A.tmp 1544 4CD8.tmp 976 4D26.tmp 4144 4DB2.tmp 1244 4E20.tmp 4280 4E7E.tmp 4484 4EEB.tmp 4556 4F58.tmp 2372 4FB6.tmp 1612 5004.tmp 3240 5081.tmp 3552 50CF.tmp 3944 512D.tmp 3128 51BA.tmp 4800 5237.tmp 220 52A4.tmp 2632 5302.tmp 4664 537F.tmp 4364 53CD.tmp 2492 541B.tmp 1204 5469.tmp 4588 54B7.tmp 1212 5515.tmp 3680 5563.tmp 4296 55B1.tmp 3724 55FF.tmp 2016 564E.tmp 2388 569C.tmp 4028 56F9.tmp 1176 5757.tmp 1352 57B5.tmp 2400 5813.tmp 1624 5870.tmp 2948 58CE.tmp 3664 592C.tmp 3204 598A.tmp 2956 59E7.tmp 2356 5A36.tmp 4196 5A84.tmp 2920 5AD2.tmp 4180 5B30.tmp 1316 5B8D.tmp 1508 5BEB.tmp 1544 5C49.tmp 1256 5CA7.tmp 3476 5CF5.tmp 3296 5D52.tmp 1244 5DA1.tmp 2088 5DFE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 2788 4768 2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe 82 PID 4768 wrote to memory of 2788 4768 2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe 82 PID 4768 wrote to memory of 2788 4768 2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe 82 PID 2788 wrote to memory of 60 2788 45D3.tmp 83 PID 2788 wrote to memory of 60 2788 45D3.tmp 83 PID 2788 wrote to memory of 60 2788 45D3.tmp 83 PID 60 wrote to memory of 952 60 466F.tmp 85 PID 60 wrote to memory of 952 60 466F.tmp 85 PID 60 wrote to memory of 952 60 466F.tmp 85 PID 952 wrote to memory of 3140 952 46DC.tmp 87 PID 952 wrote to memory of 3140 952 46DC.tmp 87 PID 952 wrote to memory of 3140 952 46DC.tmp 87 PID 3140 wrote to memory of 1928 3140 474A.tmp 89 PID 3140 wrote to memory of 1928 3140 474A.tmp 89 PID 3140 wrote to memory of 1928 3140 474A.tmp 89 PID 1928 wrote to memory of 1512 1928 47C7.tmp 91 PID 1928 wrote to memory of 1512 1928 47C7.tmp 91 PID 1928 wrote to memory of 1512 1928 47C7.tmp 91 PID 1512 wrote to memory of 2016 1512 4825.tmp 92 PID 1512 wrote to memory of 2016 1512 4825.tmp 92 PID 1512 wrote to memory of 2016 1512 4825.tmp 92 PID 2016 wrote to memory of 4440 2016 4873.tmp 93 PID 2016 wrote to memory of 4440 2016 4873.tmp 93 PID 2016 wrote to memory of 4440 2016 4873.tmp 93 PID 4440 wrote to memory of 4608 4440 48D0.tmp 94 PID 4440 wrote to memory of 4608 4440 48D0.tmp 94 PID 4440 wrote to memory of 4608 4440 48D0.tmp 94 PID 4608 wrote to memory of 2752 4608 495D.tmp 95 PID 4608 wrote to memory of 2752 4608 495D.tmp 95 PID 4608 wrote to memory of 2752 4608 495D.tmp 95 PID 2752 wrote to memory of 4640 2752 49AB.tmp 96 PID 2752 wrote to memory of 4640 2752 49AB.tmp 96 PID 2752 wrote to memory of 4640 2752 49AB.tmp 96 PID 4640 wrote to memory of 924 4640 4A28.tmp 97 PID 4640 wrote to memory of 924 4640 4A28.tmp 97 PID 4640 wrote to memory of 924 4640 4A28.tmp 97 PID 924 wrote to memory of 2692 924 4A86.tmp 98 PID 924 wrote to memory of 2692 924 4A86.tmp 98 PID 924 wrote to memory of 2692 924 4A86.tmp 98 PID 2692 wrote to memory of 4012 2692 4AE4.tmp 99 PID 2692 wrote to memory of 4012 2692 4AE4.tmp 99 PID 2692 wrote to memory of 4012 2692 4AE4.tmp 99 PID 4012 wrote to memory of 4340 4012 4B61.tmp 100 PID 4012 wrote to memory of 4340 4012 4B61.tmp 100 PID 4012 wrote to memory of 4340 4012 4B61.tmp 100 PID 4340 wrote to memory of 2920 4340 4C0D.tmp 101 PID 4340 wrote to memory of 2920 4340 4C0D.tmp 101 PID 4340 wrote to memory of 2920 4340 4C0D.tmp 101 PID 2920 wrote to memory of 1544 2920 4C6A.tmp 102 PID 2920 wrote to memory of 1544 2920 4C6A.tmp 102 PID 2920 wrote to memory of 1544 2920 4C6A.tmp 102 PID 1544 wrote to memory of 976 1544 4CD8.tmp 103 PID 1544 wrote to memory of 976 1544 4CD8.tmp 103 PID 1544 wrote to memory of 976 1544 4CD8.tmp 103 PID 976 wrote to memory of 4144 976 4D26.tmp 104 PID 976 wrote to memory of 4144 976 4D26.tmp 104 PID 976 wrote to memory of 4144 976 4D26.tmp 104 PID 4144 wrote to memory of 1244 4144 4DB2.tmp 105 PID 4144 wrote to memory of 1244 4144 4DB2.tmp 105 PID 4144 wrote to memory of 1244 4144 4DB2.tmp 105 PID 1244 wrote to memory of 4280 1244 4E20.tmp 106 PID 1244 wrote to memory of 4280 1244 4E20.tmp 106 PID 1244 wrote to memory of 4280 1244 4E20.tmp 106 PID 4280 wrote to memory of 4484 4280 4E7E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-07_95eece999d11306378054550b1eacc0e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"23⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"24⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"25⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"26⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"27⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"28⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"29⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"30⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"31⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"32⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"33⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"34⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"35⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"36⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"37⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"38⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"39⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"40⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"42⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"43⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"44⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"45⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"46⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"47⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"48⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"49⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"50⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"51⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"52⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"53⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"54⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"55⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"56⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"57⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"58⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"59⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"60⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"61⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"62⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"63⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"64⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"65⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"66⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"67⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"68⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"69⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"70⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"72⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"73⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"74⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"75⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"76⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"77⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"78⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"79⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"80⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"81⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"82⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"83⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"84⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"85⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"86⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"87⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"88⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"89⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"90⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"91⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"92⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"93⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"94⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"95⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"96⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"97⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"98⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"99⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"100⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"101⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"102⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"103⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"104⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"105⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"106⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"107⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"108⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"109⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"110⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"111⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"112⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"113⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"114⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"115⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"116⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"117⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"118⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"119⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"120⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"121⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-