Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
-
Size
536KB
-
MD5
a9ed4ab657b19ac769a76557ccd2f489
-
SHA1
87b856c2cfe8ba8be905b46f01f188cef31db8b7
-
SHA256
4cf6ddb87630da9e70162e2da95dfad692278a5a48c3c4cba37bf856cc4ba509
-
SHA512
07c2e43cd6fbb0380eeee3b288adb0e7e51c4415d433f7f2727ceb5d1a0e69383959f82edbf0419bc0ed6da2d79e8a4b81bf2cd2b567cc7159e05a18b79b10a4
-
SSDEEP
12288:wU5rCOTeiUvs8rXMal47mz1Xkr4IZxVJ0ZT9:wUQOJU0Sjl/+4IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 35E0.tmp 3644 36CA.tmp 4296 390C.tmp 756 39F7.tmp 4280 3AD2.tmp 4956 3B7D.tmp 3464 3C39.tmp 4136 3D04.tmp 1932 3E0E.tmp 3632 3ED9.tmp 4840 3F94.tmp 3104 4021.tmp 4088 40DC.tmp 1608 4188.tmp 4472 4273.tmp 4476 430F.tmp 1948 43CA.tmp 1724 4496.tmp 4732 4551.tmp 4188 460D.tmp 2248 46D8.tmp 2956 47D2.tmp 4988 489D.tmp 832 4978.tmp 1964 4A52.tmp 1000 4AEF.tmp 624 4BAA.tmp 3008 4C56.tmp 1972 4D21.tmp 1624 4DBD.tmp 1436 4E4A.tmp 3508 4F15.tmp 544 4FB1.tmp 3444 501F.tmp 3972 50AB.tmp 4788 5148.tmp 396 51D4.tmp 4476 5251.tmp 228 52BF.tmp 1724 532C.tmp 876 53C8.tmp 3328 5436.tmp 1816 54A3.tmp 2688 554F.tmp 4376 55AD.tmp 2968 5658.tmp 2820 56B6.tmp 832 5733.tmp 4616 57B0.tmp 5060 580E.tmp 2868 585C.tmp 1568 58AA.tmp 2728 58F8.tmp 4136 5966.tmp 404 59C3.tmp 4340 5A12.tmp 2692 5A7F.tmp 3620 5ADD.tmp 3964 5B3A.tmp 4764 5B98.tmp 4632 5BF6.tmp 2800 5C63.tmp 396 5CB1.tmp 4208 5D00.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1816 wrote to memory of 2940 1816 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 93 PID 1816 wrote to memory of 2940 1816 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 93 PID 1816 wrote to memory of 2940 1816 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 93 PID 2940 wrote to memory of 3644 2940 35E0.tmp 94 PID 2940 wrote to memory of 3644 2940 35E0.tmp 94 PID 2940 wrote to memory of 3644 2940 35E0.tmp 94 PID 3644 wrote to memory of 4296 3644 36CA.tmp 95 PID 3644 wrote to memory of 4296 3644 36CA.tmp 95 PID 3644 wrote to memory of 4296 3644 36CA.tmp 95 PID 4296 wrote to memory of 756 4296 390C.tmp 96 PID 4296 wrote to memory of 756 4296 390C.tmp 96 PID 4296 wrote to memory of 756 4296 390C.tmp 96 PID 756 wrote to memory of 4280 756 39F7.tmp 97 PID 756 wrote to memory of 4280 756 39F7.tmp 97 PID 756 wrote to memory of 4280 756 39F7.tmp 97 PID 4280 wrote to memory of 4956 4280 3AD2.tmp 98 PID 4280 wrote to memory of 4956 4280 3AD2.tmp 98 PID 4280 wrote to memory of 4956 4280 3AD2.tmp 98 PID 4956 wrote to memory of 3464 4956 3B7D.tmp 99 PID 4956 wrote to memory of 3464 4956 3B7D.tmp 99 PID 4956 wrote to memory of 3464 4956 3B7D.tmp 99 PID 3464 wrote to memory of 4136 3464 3C39.tmp 100 PID 3464 wrote to memory of 4136 3464 3C39.tmp 100 PID 3464 wrote to memory of 4136 3464 3C39.tmp 100 PID 4136 wrote to memory of 1932 4136 3D04.tmp 101 PID 4136 wrote to memory of 1932 4136 3D04.tmp 101 PID 4136 wrote to memory of 1932 4136 3D04.tmp 101 PID 1932 wrote to memory of 3632 1932 3E0E.tmp 102 PID 1932 wrote to memory of 3632 1932 3E0E.tmp 102 PID 1932 wrote to memory of 3632 1932 3E0E.tmp 102 PID 3632 wrote to memory of 4840 3632 3ED9.tmp 103 PID 3632 wrote to memory of 4840 3632 3ED9.tmp 103 PID 3632 wrote to memory of 4840 3632 3ED9.tmp 103 PID 4840 wrote to memory of 3104 4840 3F94.tmp 104 PID 4840 wrote to memory of 3104 4840 3F94.tmp 104 PID 4840 wrote to memory of 3104 4840 3F94.tmp 104 PID 3104 wrote to memory of 4088 3104 4021.tmp 106 PID 3104 wrote to memory of 4088 3104 4021.tmp 106 PID 3104 wrote to memory of 4088 3104 4021.tmp 106 PID 4088 wrote to memory of 1608 4088 40DC.tmp 108 PID 4088 wrote to memory of 1608 4088 40DC.tmp 108 PID 4088 wrote to memory of 1608 4088 40DC.tmp 108 PID 1608 wrote to memory of 4472 1608 4188.tmp 109 PID 1608 wrote to memory of 4472 1608 4188.tmp 109 PID 1608 wrote to memory of 4472 1608 4188.tmp 109 PID 4472 wrote to memory of 4476 4472 4273.tmp 110 PID 4472 wrote to memory of 4476 4472 4273.tmp 110 PID 4472 wrote to memory of 4476 4472 4273.tmp 110 PID 4476 wrote to memory of 1948 4476 430F.tmp 111 PID 4476 wrote to memory of 1948 4476 430F.tmp 111 PID 4476 wrote to memory of 1948 4476 430F.tmp 111 PID 1948 wrote to memory of 1724 1948 43CA.tmp 112 PID 1948 wrote to memory of 1724 1948 43CA.tmp 112 PID 1948 wrote to memory of 1724 1948 43CA.tmp 112 PID 1724 wrote to memory of 4732 1724 4496.tmp 113 PID 1724 wrote to memory of 4732 1724 4496.tmp 113 PID 1724 wrote to memory of 4732 1724 4496.tmp 113 PID 4732 wrote to memory of 4188 4732 4551.tmp 115 PID 4732 wrote to memory of 4188 4732 4551.tmp 115 PID 4732 wrote to memory of 4188 4732 4551.tmp 115 PID 4188 wrote to memory of 2248 4188 460D.tmp 116 PID 4188 wrote to memory of 2248 4188 460D.tmp 116 PID 4188 wrote to memory of 2248 4188 460D.tmp 116 PID 2248 wrote to memory of 2956 2248 46D8.tmp 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\430F.tmp"C:\Users\Admin\AppData\Local\Temp\430F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"23⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"24⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"25⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"26⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"27⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"28⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"29⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"30⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"31⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"32⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"33⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"34⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"35⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"36⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"37⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"38⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"39⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"40⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"41⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"42⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"43⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"44⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"45⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"46⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"47⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"48⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"49⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"50⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"51⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"52⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"53⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"54⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"55⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"56⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"57⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"58⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"59⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"60⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"61⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"62⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"63⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"64⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"65⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"66⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"67⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"68⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"69⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"71⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"72⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"73⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"74⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"75⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"76⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"77⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"78⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"79⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"80⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"81⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"82⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"83⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6378.tmp"C:\Users\Admin\AppData\Local\Temp\6378.tmp"84⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"85⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"86⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"87⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"88⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\651E.tmp"C:\Users\Admin\AppData\Local\Temp\651E.tmp"89⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"90⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"91⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"92⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"93⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"95⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"96⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"98⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"99⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"100⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"101⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"103⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"104⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"105⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"106⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"107⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"108⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"109⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"110⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"111⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"112⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"113⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"114⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"115⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"116⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"117⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"118⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"119⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"120⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"121⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"122⤵PID:400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-