Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 18:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe
-
Size
712KB
-
MD5
1a2e1f514ce9250e133dbc901a0e699e
-
SHA1
ce40c759ed711c1c0235ec461811869935835299
-
SHA256
521462658644b16a7a66beed812e371156f633624c0d85183e7d3119d54be646
-
SHA512
e2c3895781d9c55de868b56cfbdab6ed7978a043cc56fc9639f38556a22b8b19fb41a49ac6d87fb7599d33054a119364ad7efd17a3d60e5bffa047374dd9bca2
-
SSDEEP
12288:FU5rCOTeiDhuYIkQV1YxwIOgyxmiNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJD0NPUC/xmiNnCvq5TJLCvY90D8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3592 4D16.tmp 1012 4DE1.tmp 2740 4E6E.tmp 2308 4F1A.tmp 2972 4FA6.tmp 4688 5033.tmp 2020 5091.tmp 3564 50EF.tmp 4824 518B.tmp 1288 51E9.tmp 4820 5285.tmp 2756 5321.tmp 528 53AE.tmp 1572 543A.tmp 2504 54C7.tmp 2612 5544.tmp 2948 55A2.tmp 4680 55F0.tmp 4504 565D.tmp 2140 56CB.tmp 2844 5728.tmp 5064 57A5.tmp 2688 5822.tmp 1800 5890.tmp 792 591C.tmp 3208 59A9.tmp 3392 5A07.tmp 2440 5A64.tmp 3612 5AE1.tmp 4684 5B3F.tmp 4100 5B9D.tmp 2944 5BFB.tmp 5068 5C87.tmp 4952 5CD5.tmp 4188 5D24.tmp 2908 5D72.tmp 1664 5DC0.tmp 2044 5E1E.tmp 2816 5E6C.tmp 404 5EBA.tmp 3824 5F18.tmp 1152 5F75.tmp 4812 5FD3.tmp 3720 6031.tmp 1692 609E.tmp 1268 60EC.tmp 2404 614A.tmp 1056 61A8.tmp 4756 6206.tmp 2264 6263.tmp 4584 62B1.tmp 3048 6300.tmp 3816 635D.tmp 1980 63BB.tmp 4532 6419.tmp 4872 6467.tmp 4580 64B5.tmp 2408 6503.tmp 4868 6551.tmp 4460 659F.tmp 4980 65EE.tmp 1604 664B.tmp 3920 66A9.tmp 1248 66F7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 3592 1812 2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe 79 PID 1812 wrote to memory of 3592 1812 2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe 79 PID 1812 wrote to memory of 3592 1812 2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe 79 PID 3592 wrote to memory of 1012 3592 4D16.tmp 80 PID 3592 wrote to memory of 1012 3592 4D16.tmp 80 PID 3592 wrote to memory of 1012 3592 4D16.tmp 80 PID 1012 wrote to memory of 2740 1012 4DE1.tmp 81 PID 1012 wrote to memory of 2740 1012 4DE1.tmp 81 PID 1012 wrote to memory of 2740 1012 4DE1.tmp 81 PID 2740 wrote to memory of 2308 2740 4E6E.tmp 82 PID 2740 wrote to memory of 2308 2740 4E6E.tmp 82 PID 2740 wrote to memory of 2308 2740 4E6E.tmp 82 PID 2308 wrote to memory of 2972 2308 4F1A.tmp 83 PID 2308 wrote to memory of 2972 2308 4F1A.tmp 83 PID 2308 wrote to memory of 2972 2308 4F1A.tmp 83 PID 2972 wrote to memory of 4688 2972 4FA6.tmp 84 PID 2972 wrote to memory of 4688 2972 4FA6.tmp 84 PID 2972 wrote to memory of 4688 2972 4FA6.tmp 84 PID 4688 wrote to memory of 2020 4688 5033.tmp 85 PID 4688 wrote to memory of 2020 4688 5033.tmp 85 PID 4688 wrote to memory of 2020 4688 5033.tmp 85 PID 2020 wrote to memory of 3564 2020 5091.tmp 86 PID 2020 wrote to memory of 3564 2020 5091.tmp 86 PID 2020 wrote to memory of 3564 2020 5091.tmp 86 PID 3564 wrote to memory of 4824 3564 50EF.tmp 87 PID 3564 wrote to memory of 4824 3564 50EF.tmp 87 PID 3564 wrote to memory of 4824 3564 50EF.tmp 87 PID 4824 wrote to memory of 1288 4824 518B.tmp 88 PID 4824 wrote to memory of 1288 4824 518B.tmp 88 PID 4824 wrote to memory of 1288 4824 518B.tmp 88 PID 1288 wrote to memory of 4820 1288 51E9.tmp 89 PID 1288 wrote to memory of 4820 1288 51E9.tmp 89 PID 1288 wrote to memory of 4820 1288 51E9.tmp 89 PID 4820 wrote to memory of 2756 4820 5285.tmp 90 PID 4820 wrote to memory of 2756 4820 5285.tmp 90 PID 4820 wrote to memory of 2756 4820 5285.tmp 90 PID 2756 wrote to memory of 528 2756 5321.tmp 91 PID 2756 wrote to memory of 528 2756 5321.tmp 91 PID 2756 wrote to memory of 528 2756 5321.tmp 91 PID 528 wrote to memory of 1572 528 53AE.tmp 92 PID 528 wrote to memory of 1572 528 53AE.tmp 92 PID 528 wrote to memory of 1572 528 53AE.tmp 92 PID 1572 wrote to memory of 2504 1572 543A.tmp 93 PID 1572 wrote to memory of 2504 1572 543A.tmp 93 PID 1572 wrote to memory of 2504 1572 543A.tmp 93 PID 2504 wrote to memory of 2612 2504 54C7.tmp 94 PID 2504 wrote to memory of 2612 2504 54C7.tmp 94 PID 2504 wrote to memory of 2612 2504 54C7.tmp 94 PID 2612 wrote to memory of 2948 2612 5544.tmp 95 PID 2612 wrote to memory of 2948 2612 5544.tmp 95 PID 2612 wrote to memory of 2948 2612 5544.tmp 95 PID 2948 wrote to memory of 4680 2948 55A2.tmp 96 PID 2948 wrote to memory of 4680 2948 55A2.tmp 96 PID 2948 wrote to memory of 4680 2948 55A2.tmp 96 PID 4680 wrote to memory of 4504 4680 55F0.tmp 97 PID 4680 wrote to memory of 4504 4680 55F0.tmp 97 PID 4680 wrote to memory of 4504 4680 55F0.tmp 97 PID 4504 wrote to memory of 2140 4504 565D.tmp 98 PID 4504 wrote to memory of 2140 4504 565D.tmp 98 PID 4504 wrote to memory of 2140 4504 565D.tmp 98 PID 2140 wrote to memory of 2844 2140 56CB.tmp 99 PID 2140 wrote to memory of 2844 2140 56CB.tmp 99 PID 2140 wrote to memory of 2844 2140 56CB.tmp 99 PID 2844 wrote to memory of 5064 2844 5728.tmp 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_1a2e1f514ce9250e133dbc901a0e699e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"23⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"24⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"25⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"26⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"27⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"28⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"29⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"30⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"31⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"32⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"33⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"34⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"35⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"36⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"37⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"38⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"39⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"40⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"41⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"42⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"43⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"44⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"45⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"46⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"47⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"48⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"49⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"50⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"51⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"52⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"53⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"54⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"55⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"56⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"57⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"58⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"59⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"60⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"61⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"62⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"63⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"64⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"65⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"66⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"67⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"68⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"69⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"70⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"71⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"72⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"73⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"74⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"75⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"76⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"77⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"78⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"79⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"80⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"81⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"82⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"83⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"84⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"85⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"86⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"87⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"88⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"89⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"90⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"91⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"94⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"95⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"96⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"97⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"98⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"99⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"100⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"101⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"102⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"103⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"104⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"105⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"106⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"107⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"108⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"109⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"110⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"111⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"113⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"114⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"115⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"116⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"117⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"118⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"119⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"121⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-