Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe
-
Size
765KB
-
MD5
b2de573d7b87236b7eb8f437c3413e50
-
SHA1
72bdd6f3a70b8ff71de19205efe106750444c694
-
SHA256
4ddc24a5378174bd56ab43781fcaf3b33f4fb2413d30953ff921d18617d904e6
-
SHA512
029ebc418b6f3a5ab08d275332bd724890a66f881bc4fbc7443f61ba6589f1bbaf04809dfacb72e29a6a378858f644924a3df35d6ad205326787411e5a6ab325
-
SSDEEP
12288:ZU5rCOTeiDzJibnkHAviMExMOT9/gS+96oceb3ZF5rn5rLOa54U5w5A:ZUQOJDwneAaMEeOT9S6Mb3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1352 4508.tmp 1312 45C3.tmp 208 4621.tmp 4776 468E.tmp 4864 46FC.tmp 3020 4769.tmp 2224 47D6.tmp 2436 4844.tmp 4000 4892.tmp 2460 491F.tmp 1524 498C.tmp 872 49DA.tmp 4024 4A38.tmp 4580 4A86.tmp 4836 4B03.tmp 3944 4B70.tmp 4752 4BBE.tmp 3228 4C1C.tmp 3640 4CA9.tmp 1540 4CF7.tmp 3064 4D55.tmp 1484 4DA3.tmp 4728 4E10.tmp 3216 4E9D.tmp 4828 4EFB.tmp 1592 4F78.tmp 1364 4FD5.tmp 5100 5033.tmp 4484 50A0.tmp 1492 50EF.tmp 940 514C.tmp 3040 51AA.tmp 2588 51F8.tmp 2972 5285.tmp 3016 52D3.tmp 4640 5321.tmp 4904 536F.tmp 4660 53BD.tmp 1816 540B.tmp 5064 545A.tmp 3844 54A8.tmp 740 5505.tmp 1016 5573.tmp 4236 55C1.tmp 4628 564E.tmp 3764 56BB.tmp 2744 5738.tmp 2748 5796.tmp 4552 5822.tmp 4524 58BF.tmp 3284 596A.tmp 4020 59D8.tmp 3104 5A26.tmp 1744 5A84.tmp 2016 5AE1.tmp 4804 5B3F.tmp 1572 5B8D.tmp 2968 5BEB.tmp 5020 5C49.tmp 680 5CA7.tmp 4424 5D04.tmp 2380 5D62.tmp 1780 5DB0.tmp 4268 5DFE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 1352 4060 2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe 81 PID 4060 wrote to memory of 1352 4060 2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe 81 PID 4060 wrote to memory of 1352 4060 2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe 81 PID 1352 wrote to memory of 1312 1352 4508.tmp 82 PID 1352 wrote to memory of 1312 1352 4508.tmp 82 PID 1352 wrote to memory of 1312 1352 4508.tmp 82 PID 1312 wrote to memory of 208 1312 45C3.tmp 83 PID 1312 wrote to memory of 208 1312 45C3.tmp 83 PID 1312 wrote to memory of 208 1312 45C3.tmp 83 PID 208 wrote to memory of 4776 208 4621.tmp 84 PID 208 wrote to memory of 4776 208 4621.tmp 84 PID 208 wrote to memory of 4776 208 4621.tmp 84 PID 4776 wrote to memory of 4864 4776 468E.tmp 85 PID 4776 wrote to memory of 4864 4776 468E.tmp 85 PID 4776 wrote to memory of 4864 4776 468E.tmp 85 PID 4864 wrote to memory of 3020 4864 46FC.tmp 86 PID 4864 wrote to memory of 3020 4864 46FC.tmp 86 PID 4864 wrote to memory of 3020 4864 46FC.tmp 86 PID 3020 wrote to memory of 2224 3020 4769.tmp 87 PID 3020 wrote to memory of 2224 3020 4769.tmp 87 PID 3020 wrote to memory of 2224 3020 4769.tmp 87 PID 2224 wrote to memory of 2436 2224 47D6.tmp 88 PID 2224 wrote to memory of 2436 2224 47D6.tmp 88 PID 2224 wrote to memory of 2436 2224 47D6.tmp 88 PID 2436 wrote to memory of 4000 2436 4844.tmp 89 PID 2436 wrote to memory of 4000 2436 4844.tmp 89 PID 2436 wrote to memory of 4000 2436 4844.tmp 89 PID 4000 wrote to memory of 2460 4000 4892.tmp 90 PID 4000 wrote to memory of 2460 4000 4892.tmp 90 PID 4000 wrote to memory of 2460 4000 4892.tmp 90 PID 2460 wrote to memory of 1524 2460 491F.tmp 91 PID 2460 wrote to memory of 1524 2460 491F.tmp 91 PID 2460 wrote to memory of 1524 2460 491F.tmp 91 PID 1524 wrote to memory of 872 1524 498C.tmp 92 PID 1524 wrote to memory of 872 1524 498C.tmp 92 PID 1524 wrote to memory of 872 1524 498C.tmp 92 PID 872 wrote to memory of 4024 872 49DA.tmp 93 PID 872 wrote to memory of 4024 872 49DA.tmp 93 PID 872 wrote to memory of 4024 872 49DA.tmp 93 PID 4024 wrote to memory of 4580 4024 4A38.tmp 94 PID 4024 wrote to memory of 4580 4024 4A38.tmp 94 PID 4024 wrote to memory of 4580 4024 4A38.tmp 94 PID 4580 wrote to memory of 4836 4580 4A86.tmp 95 PID 4580 wrote to memory of 4836 4580 4A86.tmp 95 PID 4580 wrote to memory of 4836 4580 4A86.tmp 95 PID 4836 wrote to memory of 3944 4836 4B03.tmp 96 PID 4836 wrote to memory of 3944 4836 4B03.tmp 96 PID 4836 wrote to memory of 3944 4836 4B03.tmp 96 PID 3944 wrote to memory of 4752 3944 4B70.tmp 97 PID 3944 wrote to memory of 4752 3944 4B70.tmp 97 PID 3944 wrote to memory of 4752 3944 4B70.tmp 97 PID 4752 wrote to memory of 3228 4752 4BBE.tmp 98 PID 4752 wrote to memory of 3228 4752 4BBE.tmp 98 PID 4752 wrote to memory of 3228 4752 4BBE.tmp 98 PID 3228 wrote to memory of 3640 3228 4C1C.tmp 99 PID 3228 wrote to memory of 3640 3228 4C1C.tmp 99 PID 3228 wrote to memory of 3640 3228 4C1C.tmp 99 PID 3640 wrote to memory of 1540 3640 4CA9.tmp 100 PID 3640 wrote to memory of 1540 3640 4CA9.tmp 100 PID 3640 wrote to memory of 1540 3640 4CA9.tmp 100 PID 1540 wrote to memory of 3064 1540 4CF7.tmp 101 PID 1540 wrote to memory of 3064 1540 4CF7.tmp 101 PID 1540 wrote to memory of 3064 1540 4CF7.tmp 101 PID 3064 wrote to memory of 1484 3064 4D55.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_b2de573d7b87236b7eb8f437c3413e50_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"23⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"24⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"25⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"26⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"27⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"28⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"29⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"30⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"31⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"32⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"33⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"34⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"35⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"36⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"37⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"38⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"39⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"40⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"41⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"42⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"43⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"44⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"45⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"46⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"47⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"48⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"49⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"50⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"51⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"52⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"53⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"54⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"55⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"56⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"57⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"58⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"59⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"60⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"61⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"62⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"63⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"64⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"65⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"66⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"67⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"68⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"69⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"71⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"72⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"73⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"74⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"75⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"76⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"77⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"78⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"79⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"80⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"81⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"82⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"83⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"84⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"85⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"86⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"87⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"88⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"89⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"90⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"91⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"92⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"93⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"94⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"95⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"96⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"97⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"98⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"99⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"100⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"101⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"102⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"103⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"104⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"105⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"106⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"107⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"108⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"109⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"110⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"111⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"112⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"113⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"114⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"115⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"116⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"117⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"118⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"119⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"120⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"121⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-