Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 17:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe
-
Size
520KB
-
MD5
a78d9e33454d3c6784db4015b9973a10
-
SHA1
6e3d5dbc5596e29917201e3b62a4f35ddb60db6d
-
SHA256
ca10221ec96101db70051e45a4188ef6c507d91f2883ad8737fe6fffa9eeeaea
-
SHA512
ca2f4d518cd33dc8041f3dc223949500e9c0473864ace08d46c7d6663fc150f750c8cd16ee2c66be4cbe0425ba55a17497f89de4f34498ff520a14e3fea90921
-
SSDEEP
12288:gj8fuxR21t5i8fmMPL9SnnUgHNKnzqBcNNZ:gj8fuK1GYmTvNKzQcNN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1160 466F.tmp 1240 46EC.tmp 684 4779.tmp 4180 4815.tmp 1348 48A2.tmp 3988 490F.tmp 2600 496D.tmp 908 49CA.tmp 612 4A28.tmp 100 4A86.tmp 3932 4AF3.tmp 2308 4B41.tmp 4216 4B9F.tmp 1336 4BED.tmp 1184 4C6A.tmp 4692 4CB8.tmp 3648 4D35.tmp 3112 4DB2.tmp 4960 4E10.tmp 2260 4E8D.tmp 2900 4F0A.tmp 3992 4F58.tmp 392 4FC6.tmp 2672 5014.tmp 4584 5081.tmp 2104 50CF.tmp 4912 513D.tmp 1596 51BA.tmp 836 5237.tmp 1840 52B4.tmp 1748 5321.tmp 3172 538E.tmp 1900 53FC.tmp 3604 545A.tmp 4928 54B7.tmp 4688 5505.tmp 1084 5563.tmp 1908 55B1.tmp 1520 560F.tmp 4116 565D.tmp 4856 56BB.tmp 2376 5719.tmp 2244 5776.tmp 432 57D4.tmp 3728 5832.tmp 1652 5890.tmp 4936 58ED.tmp 4636 593C.tmp 376 598A.tmp 1152 59F7.tmp 4572 5A55.tmp 4252 5AA3.tmp 2188 5AF1.tmp 2856 5B3F.tmp 4756 5B8D.tmp 2676 5BEB.tmp 3248 5C49.tmp 2736 5CA7.tmp 3348 5CF5.tmp 4532 5D43.tmp 220 5DA1.tmp 3336 5DEF.tmp 972 5E3D.tmp 4228 5E9B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 1160 4744 2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe 81 PID 4744 wrote to memory of 1160 4744 2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe 81 PID 4744 wrote to memory of 1160 4744 2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe 81 PID 1160 wrote to memory of 1240 1160 466F.tmp 82 PID 1160 wrote to memory of 1240 1160 466F.tmp 82 PID 1160 wrote to memory of 1240 1160 466F.tmp 82 PID 1240 wrote to memory of 684 1240 46EC.tmp 83 PID 1240 wrote to memory of 684 1240 46EC.tmp 83 PID 1240 wrote to memory of 684 1240 46EC.tmp 83 PID 684 wrote to memory of 4180 684 4779.tmp 84 PID 684 wrote to memory of 4180 684 4779.tmp 84 PID 684 wrote to memory of 4180 684 4779.tmp 84 PID 4180 wrote to memory of 1348 4180 4815.tmp 85 PID 4180 wrote to memory of 1348 4180 4815.tmp 85 PID 4180 wrote to memory of 1348 4180 4815.tmp 85 PID 1348 wrote to memory of 3988 1348 48A2.tmp 86 PID 1348 wrote to memory of 3988 1348 48A2.tmp 86 PID 1348 wrote to memory of 3988 1348 48A2.tmp 86 PID 3988 wrote to memory of 2600 3988 490F.tmp 87 PID 3988 wrote to memory of 2600 3988 490F.tmp 87 PID 3988 wrote to memory of 2600 3988 490F.tmp 87 PID 2600 wrote to memory of 908 2600 496D.tmp 88 PID 2600 wrote to memory of 908 2600 496D.tmp 88 PID 2600 wrote to memory of 908 2600 496D.tmp 88 PID 908 wrote to memory of 612 908 49CA.tmp 89 PID 908 wrote to memory of 612 908 49CA.tmp 89 PID 908 wrote to memory of 612 908 49CA.tmp 89 PID 612 wrote to memory of 100 612 4A28.tmp 90 PID 612 wrote to memory of 100 612 4A28.tmp 90 PID 612 wrote to memory of 100 612 4A28.tmp 90 PID 100 wrote to memory of 3932 100 4A86.tmp 91 PID 100 wrote to memory of 3932 100 4A86.tmp 91 PID 100 wrote to memory of 3932 100 4A86.tmp 91 PID 3932 wrote to memory of 2308 3932 4AF3.tmp 92 PID 3932 wrote to memory of 2308 3932 4AF3.tmp 92 PID 3932 wrote to memory of 2308 3932 4AF3.tmp 92 PID 2308 wrote to memory of 4216 2308 4B41.tmp 93 PID 2308 wrote to memory of 4216 2308 4B41.tmp 93 PID 2308 wrote to memory of 4216 2308 4B41.tmp 93 PID 4216 wrote to memory of 1336 4216 4B9F.tmp 94 PID 4216 wrote to memory of 1336 4216 4B9F.tmp 94 PID 4216 wrote to memory of 1336 4216 4B9F.tmp 94 PID 1336 wrote to memory of 1184 1336 4BED.tmp 95 PID 1336 wrote to memory of 1184 1336 4BED.tmp 95 PID 1336 wrote to memory of 1184 1336 4BED.tmp 95 PID 1184 wrote to memory of 4692 1184 4C6A.tmp 96 PID 1184 wrote to memory of 4692 1184 4C6A.tmp 96 PID 1184 wrote to memory of 4692 1184 4C6A.tmp 96 PID 4692 wrote to memory of 3648 4692 4CB8.tmp 97 PID 4692 wrote to memory of 3648 4692 4CB8.tmp 97 PID 4692 wrote to memory of 3648 4692 4CB8.tmp 97 PID 3648 wrote to memory of 3112 3648 4D35.tmp 98 PID 3648 wrote to memory of 3112 3648 4D35.tmp 98 PID 3648 wrote to memory of 3112 3648 4D35.tmp 98 PID 3112 wrote to memory of 4960 3112 4DB2.tmp 99 PID 3112 wrote to memory of 4960 3112 4DB2.tmp 99 PID 3112 wrote to memory of 4960 3112 4DB2.tmp 99 PID 4960 wrote to memory of 2260 4960 4E10.tmp 100 PID 4960 wrote to memory of 2260 4960 4E10.tmp 100 PID 4960 wrote to memory of 2260 4960 4E10.tmp 100 PID 2260 wrote to memory of 2900 2260 4E8D.tmp 101 PID 2260 wrote to memory of 2900 2260 4E8D.tmp 101 PID 2260 wrote to memory of 2900 2260 4E8D.tmp 101 PID 2900 wrote to memory of 3992 2900 4F0A.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_a78d9e33454d3c6784db4015b9973a10_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"23⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"24⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"25⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"26⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"27⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"28⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"29⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"30⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"31⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"32⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"33⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"34⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"35⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"36⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"37⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"38⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"39⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"40⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"41⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"42⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"43⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"44⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"45⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"46⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"47⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"48⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"49⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"50⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"51⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"52⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"53⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"54⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"55⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"56⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"57⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"58⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"59⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"60⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"61⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"62⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"63⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"64⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"65⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"66⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"67⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"68⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"69⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"70⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"71⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"73⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"74⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"75⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"76⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"77⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"78⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"79⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"80⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"81⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"82⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"83⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"84⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"85⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"86⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"87⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"88⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"89⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"90⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"91⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"92⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"93⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"94⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"95⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"96⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"97⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"98⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"99⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"100⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"101⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"103⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"104⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"105⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"106⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"107⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"108⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"109⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"110⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"111⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"112⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"113⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"114⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"115⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"116⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"117⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"118⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"119⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"120⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"121⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-