Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe
-
Size
486KB
-
MD5
1be5a1b896d07b5f5db0cb78a4f8447b
-
SHA1
753bdb61c310f463807c75f761dd051e07982318
-
SHA256
a97a0f1c7fa26066564ad0fdb5a8ac89f7f2e8f8461c9c97761b22935dd7a96a
-
SHA512
f73c403ad2abb92c7b51dae5857497f67e1dc14dee3b4fdd29be60db777421a304dc3b64ee162b3ecd8dd25c7358368deacc66e21326ae326acf6f9aef4c60a2
-
SSDEEP
12288:/U5rCOTeiDlalL+aY0fBf7+55kA8XqFNZ:/UQOJDlarYEBfKHG6FN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1880 47C7.tmp 2696 4853.tmp 4688 48B1.tmp 2512 492E.tmp 4416 498C.tmp 3668 49F9.tmp 4812 4A67.tmp 2884 4AE4.tmp 2608 4B32.tmp 1424 4B90.tmp 4816 4BDE.tmp 1168 4C4B.tmp 1372 4CA9.tmp 3136 4D26.tmp 556 4D84.tmp 2856 4DF1.tmp 3056 4E3F.tmp 3112 4E8D.tmp 768 4EEB.tmp 4748 4F49.tmp 5088 4FB6.tmp 1644 5014.tmp 396 5052.tmp 2088 50A0.tmp 2064 50FE.tmp 1492 517B.tmp 3048 51D9.tmp 1864 5256.tmp 1872 52C3.tmp 1184 5331.tmp 3484 537F.tmp 4680 53EC.tmp 3744 543A.tmp 1316 5488.tmp 2460 54D7.tmp 3732 5534.tmp 780 5582.tmp 2120 55D1.tmp 1688 563E.tmp 4000 569C.tmp 3332 56EA.tmp 1924 5748.tmp 3368 57A5.tmp 1652 5803.tmp 1432 5851.tmp 4556 58AF.tmp 3304 58FD.tmp 4336 594B.tmp 2944 59A9.tmp 3936 5A07.tmp 3152 5A55.tmp 2172 5AA3.tmp 2256 5B20.tmp 5052 5B6E.tmp 4396 5BBC.tmp 4688 5C0A.tmp 1420 5C68.tmp 3096 5CC6.tmp 3352 5D14.tmp 4820 5D62.tmp 436 5DB0.tmp 452 5DFE.tmp 2884 5E4C.tmp 1456 5EAA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 1880 3548 2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe 83 PID 3548 wrote to memory of 1880 3548 2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe 83 PID 3548 wrote to memory of 1880 3548 2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe 83 PID 1880 wrote to memory of 2696 1880 47C7.tmp 85 PID 1880 wrote to memory of 2696 1880 47C7.tmp 85 PID 1880 wrote to memory of 2696 1880 47C7.tmp 85 PID 2696 wrote to memory of 4688 2696 4853.tmp 86 PID 2696 wrote to memory of 4688 2696 4853.tmp 86 PID 2696 wrote to memory of 4688 2696 4853.tmp 86 PID 4688 wrote to memory of 2512 4688 48B1.tmp 87 PID 4688 wrote to memory of 2512 4688 48B1.tmp 87 PID 4688 wrote to memory of 2512 4688 48B1.tmp 87 PID 2512 wrote to memory of 4416 2512 492E.tmp 88 PID 2512 wrote to memory of 4416 2512 492E.tmp 88 PID 2512 wrote to memory of 4416 2512 492E.tmp 88 PID 4416 wrote to memory of 3668 4416 498C.tmp 89 PID 4416 wrote to memory of 3668 4416 498C.tmp 89 PID 4416 wrote to memory of 3668 4416 498C.tmp 89 PID 3668 wrote to memory of 4812 3668 49F9.tmp 90 PID 3668 wrote to memory of 4812 3668 49F9.tmp 90 PID 3668 wrote to memory of 4812 3668 49F9.tmp 90 PID 4812 wrote to memory of 2884 4812 4A67.tmp 91 PID 4812 wrote to memory of 2884 4812 4A67.tmp 91 PID 4812 wrote to memory of 2884 4812 4A67.tmp 91 PID 2884 wrote to memory of 2608 2884 4AE4.tmp 92 PID 2884 wrote to memory of 2608 2884 4AE4.tmp 92 PID 2884 wrote to memory of 2608 2884 4AE4.tmp 92 PID 2608 wrote to memory of 1424 2608 4B32.tmp 93 PID 2608 wrote to memory of 1424 2608 4B32.tmp 93 PID 2608 wrote to memory of 1424 2608 4B32.tmp 93 PID 1424 wrote to memory of 4816 1424 4B90.tmp 94 PID 1424 wrote to memory of 4816 1424 4B90.tmp 94 PID 1424 wrote to memory of 4816 1424 4B90.tmp 94 PID 4816 wrote to memory of 1168 4816 4BDE.tmp 96 PID 4816 wrote to memory of 1168 4816 4BDE.tmp 96 PID 4816 wrote to memory of 1168 4816 4BDE.tmp 96 PID 1168 wrote to memory of 1372 1168 4C4B.tmp 97 PID 1168 wrote to memory of 1372 1168 4C4B.tmp 97 PID 1168 wrote to memory of 1372 1168 4C4B.tmp 97 PID 1372 wrote to memory of 3136 1372 4CA9.tmp 98 PID 1372 wrote to memory of 3136 1372 4CA9.tmp 98 PID 1372 wrote to memory of 3136 1372 4CA9.tmp 98 PID 3136 wrote to memory of 556 3136 4D26.tmp 99 PID 3136 wrote to memory of 556 3136 4D26.tmp 99 PID 3136 wrote to memory of 556 3136 4D26.tmp 99 PID 556 wrote to memory of 2856 556 4D84.tmp 100 PID 556 wrote to memory of 2856 556 4D84.tmp 100 PID 556 wrote to memory of 2856 556 4D84.tmp 100 PID 2856 wrote to memory of 3056 2856 4DF1.tmp 101 PID 2856 wrote to memory of 3056 2856 4DF1.tmp 101 PID 2856 wrote to memory of 3056 2856 4DF1.tmp 101 PID 3056 wrote to memory of 3112 3056 4E3F.tmp 103 PID 3056 wrote to memory of 3112 3056 4E3F.tmp 103 PID 3056 wrote to memory of 3112 3056 4E3F.tmp 103 PID 3112 wrote to memory of 768 3112 4E8D.tmp 104 PID 3112 wrote to memory of 768 3112 4E8D.tmp 104 PID 3112 wrote to memory of 768 3112 4E8D.tmp 104 PID 768 wrote to memory of 4748 768 4EEB.tmp 105 PID 768 wrote to memory of 4748 768 4EEB.tmp 105 PID 768 wrote to memory of 4748 768 4EEB.tmp 105 PID 4748 wrote to memory of 5088 4748 4F49.tmp 106 PID 4748 wrote to memory of 5088 4748 4F49.tmp 106 PID 4748 wrote to memory of 5088 4748 4F49.tmp 106 PID 5088 wrote to memory of 1644 5088 4FB6.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_1be5a1b896d07b5f5db0cb78a4f8447b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"23⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"24⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"25⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"26⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"27⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"28⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"29⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"30⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"31⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"32⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"33⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"34⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"35⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"36⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"37⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"38⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"39⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"40⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"41⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"42⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"43⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"44⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"45⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"47⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"48⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"49⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"50⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"51⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"52⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"53⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"54⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"55⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"56⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"57⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"58⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"59⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"60⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"61⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"62⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"63⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"64⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"65⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"66⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"67⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"68⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"69⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"70⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"71⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"72⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"73⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"74⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"75⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"76⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"77⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"78⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"79⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"80⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"81⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"82⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"83⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"84⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"85⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"86⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"87⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"88⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"89⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"90⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"91⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"92⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"93⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"94⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"95⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"96⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"97⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"98⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"99⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"100⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"101⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"102⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"103⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"104⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"105⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"106⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"107⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"108⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"109⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"110⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"111⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"112⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"113⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"114⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"115⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"116⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"117⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"118⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"119⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"120⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"121⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"122⤵PID:1544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-