Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 16:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe
-
Size
487KB
-
MD5
10e4d23f740d520970c368dc6a03a641
-
SHA1
89e80ac43791e46ac20088022a1bc10b9ec5bfd9
-
SHA256
5f9e573236e1a3cac1f6786935cc15437c098bc25b3b1115ae73ac298d6838c6
-
SHA512
27fd5d28ebf9e7b02767e235c3aa711e5b75b4bf2af5d4857854c50d818eeb3c120474124058657cd8490c22e560aa8b21fc241ebb5514513172137cc7bbc791
-
SSDEEP
12288:HU5rCOTeiJbjOhw8OTuN2FJZS28naFhVNZ:HUQOJJbuXIi/mVN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4624 4D07.tmp 5028 4DB2.tmp 2184 4E4F.tmp 3052 4EDB.tmp 2380 4F39.tmp 1908 4FA6.tmp 1572 5004.tmp 4888 5062.tmp 2644 50EF.tmp 4644 514C.tmp 3468 51AA.tmp 2536 51F8.tmp 4864 5275.tmp 4976 52C3.tmp 3548 5321.tmp 3648 536F.tmp 4336 53CD.tmp 3248 544A.tmp 1884 54B7.tmp 3688 5505.tmp 4364 5573.tmp 3280 55E0.tmp 4072 563E.tmp 636 56BB.tmp 2980 5719.tmp 5068 5786.tmp 3540 57D4.tmp 4200 5851.tmp 4460 589F.tmp 1280 58FD.tmp 2160 595B.tmp 4352 59D8.tmp 4060 5A36.tmp 4400 5A84.tmp 2076 5AE1.tmp 3292 5B3F.tmp 4840 5B9D.tmp 2220 5C0A.tmp 2864 5C68.tmp 1360 5CC6.tmp 4776 5D24.tmp 1976 5D91.tmp 4396 5DEF.tmp 4880 5E4C.tmp 2156 5E9B.tmp 5016 5EF8.tmp 1332 5F46.tmp 1244 5F95.tmp 404 5FF2.tmp 4236 6040.tmp 4084 60CD.tmp 4384 612B.tmp 1716 61C7.tmp 1588 6225.tmp 4624 6283.tmp 620 62E0.tmp 5028 632E.tmp 4076 638C.tmp 1556 63EA.tmp 5048 6438.tmp 1548 6486.tmp 1864 64D4.tmp 1724 6542.tmp 3568 65AF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4624 4648 2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe 82 PID 4648 wrote to memory of 4624 4648 2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe 82 PID 4648 wrote to memory of 4624 4648 2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe 82 PID 4624 wrote to memory of 5028 4624 4D07.tmp 83 PID 4624 wrote to memory of 5028 4624 4D07.tmp 83 PID 4624 wrote to memory of 5028 4624 4D07.tmp 83 PID 5028 wrote to memory of 2184 5028 4DB2.tmp 84 PID 5028 wrote to memory of 2184 5028 4DB2.tmp 84 PID 5028 wrote to memory of 2184 5028 4DB2.tmp 84 PID 2184 wrote to memory of 3052 2184 4E4F.tmp 85 PID 2184 wrote to memory of 3052 2184 4E4F.tmp 85 PID 2184 wrote to memory of 3052 2184 4E4F.tmp 85 PID 3052 wrote to memory of 2380 3052 4EDB.tmp 86 PID 3052 wrote to memory of 2380 3052 4EDB.tmp 86 PID 3052 wrote to memory of 2380 3052 4EDB.tmp 86 PID 2380 wrote to memory of 1908 2380 4F39.tmp 87 PID 2380 wrote to memory of 1908 2380 4F39.tmp 87 PID 2380 wrote to memory of 1908 2380 4F39.tmp 87 PID 1908 wrote to memory of 1572 1908 4FA6.tmp 88 PID 1908 wrote to memory of 1572 1908 4FA6.tmp 88 PID 1908 wrote to memory of 1572 1908 4FA6.tmp 88 PID 1572 wrote to memory of 4888 1572 5004.tmp 89 PID 1572 wrote to memory of 4888 1572 5004.tmp 89 PID 1572 wrote to memory of 4888 1572 5004.tmp 89 PID 4888 wrote to memory of 2644 4888 5062.tmp 90 PID 4888 wrote to memory of 2644 4888 5062.tmp 90 PID 4888 wrote to memory of 2644 4888 5062.tmp 90 PID 2644 wrote to memory of 4644 2644 50EF.tmp 91 PID 2644 wrote to memory of 4644 2644 50EF.tmp 91 PID 2644 wrote to memory of 4644 2644 50EF.tmp 91 PID 4644 wrote to memory of 3468 4644 514C.tmp 92 PID 4644 wrote to memory of 3468 4644 514C.tmp 92 PID 4644 wrote to memory of 3468 4644 514C.tmp 92 PID 3468 wrote to memory of 2536 3468 51AA.tmp 93 PID 3468 wrote to memory of 2536 3468 51AA.tmp 93 PID 3468 wrote to memory of 2536 3468 51AA.tmp 93 PID 2536 wrote to memory of 4864 2536 51F8.tmp 94 PID 2536 wrote to memory of 4864 2536 51F8.tmp 94 PID 2536 wrote to memory of 4864 2536 51F8.tmp 94 PID 4864 wrote to memory of 4976 4864 5275.tmp 95 PID 4864 wrote to memory of 4976 4864 5275.tmp 95 PID 4864 wrote to memory of 4976 4864 5275.tmp 95 PID 4976 wrote to memory of 3548 4976 52C3.tmp 96 PID 4976 wrote to memory of 3548 4976 52C3.tmp 96 PID 4976 wrote to memory of 3548 4976 52C3.tmp 96 PID 3548 wrote to memory of 3648 3548 5321.tmp 97 PID 3548 wrote to memory of 3648 3548 5321.tmp 97 PID 3548 wrote to memory of 3648 3548 5321.tmp 97 PID 3648 wrote to memory of 4336 3648 536F.tmp 98 PID 3648 wrote to memory of 4336 3648 536F.tmp 98 PID 3648 wrote to memory of 4336 3648 536F.tmp 98 PID 4336 wrote to memory of 3248 4336 53CD.tmp 99 PID 4336 wrote to memory of 3248 4336 53CD.tmp 99 PID 4336 wrote to memory of 3248 4336 53CD.tmp 99 PID 3248 wrote to memory of 1884 3248 544A.tmp 100 PID 3248 wrote to memory of 1884 3248 544A.tmp 100 PID 3248 wrote to memory of 1884 3248 544A.tmp 100 PID 1884 wrote to memory of 3688 1884 54B7.tmp 103 PID 1884 wrote to memory of 3688 1884 54B7.tmp 103 PID 1884 wrote to memory of 3688 1884 54B7.tmp 103 PID 3688 wrote to memory of 4364 3688 5505.tmp 104 PID 3688 wrote to memory of 4364 3688 5505.tmp 104 PID 3688 wrote to memory of 4364 3688 5505.tmp 104 PID 4364 wrote to memory of 3280 4364 5573.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_10e4d23f740d520970c368dc6a03a641_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"23⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"24⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"25⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"26⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"27⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"28⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"29⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"30⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"31⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"32⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"33⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"34⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"35⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"36⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"37⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"38⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"39⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"40⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"41⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"42⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"43⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"44⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"45⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"46⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"47⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"48⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"49⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"50⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"51⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"52⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"53⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"54⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"55⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"56⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"57⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"58⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"59⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"60⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"61⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"62⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"63⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"64⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"65⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"66⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"67⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"68⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"69⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"70⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"72⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"73⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"74⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"75⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"76⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"77⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"79⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"80⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"81⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"82⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"83⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"84⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"85⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"86⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"87⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"89⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"90⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"91⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"92⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"93⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"95⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"96⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"97⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"98⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"99⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"100⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"101⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"102⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"103⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"104⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"105⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"106⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"107⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"108⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"109⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"110⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"111⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"112⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"113⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"114⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"115⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"116⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"117⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"118⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"119⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"120⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"121⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"122⤵PID:116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-