Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 11:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe
-
Size
488KB
-
MD5
fbf9076d3cfb6ff5d7331d5853daa2d1
-
SHA1
94374d95328135b221005aa48734df1a95f2f5cf
-
SHA256
690c06e478598059887cd51e9bf4a759a4712779d14b72fd645c5a327171d5d2
-
SHA512
59e6c24984f1dd2b7e7850ff37fbee9ff3109dbcacc3bfd1c8eb4271895fecdf1fb8a3150e326bd1f9f5350f37b08edcc6680498715346fe3ae6aa7804129d2a
-
SSDEEP
12288:/U5rCOTeiDrjLsvHJtbxHJdOUOA4VT2rAA0U4lsNZ:/UQOJDTsvHJtbHf4sr0QN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1524 4805.tmp 4896 4873.tmp 1196 48D0.tmp 1068 493E.tmp 408 499C.tmp 4748 4A09.tmp 4512 4A76.tmp 2304 4AD4.tmp 3520 4B32.tmp 2068 4B80.tmp 4724 4BED.tmp 4700 4C3B.tmp 800 4CA9.tmp 3156 4D07.tmp 4364 4D55.tmp 2692 4DB2.tmp 3984 4E20.tmp 1924 4E6E.tmp 2788 4EBC.tmp 2224 4F1A.tmp 4460 4F68.tmp 2136 4FB6.tmp 5000 5023.tmp 4588 5091.tmp 4964 510E.tmp 3008 516C.tmp 2104 51AA.tmp 3348 51F8.tmp 1148 5256.tmp 3860 52A4.tmp 884 52F2.tmp 1488 5360.tmp 392 53DD.tmp 3600 542B.tmp 4684 5479.tmp 2096 54C7.tmp 1676 5525.tmp 4260 5573.tmp 1872 55D1.tmp 328 561F.tmp 1152 567C.tmp 3388 56CB.tmp 3636 5728.tmp 3324 5776.tmp 3152 57C5.tmp 3888 5822.tmp 3320 5870.tmp 5080 58BF.tmp 372 591C.tmp 3924 596A.tmp 3420 59B9.tmp 3488 5A07.tmp 448 5A55.tmp 2868 5AA3.tmp 1852 5B01.tmp 4276 5B4F.tmp 4288 5B9D.tmp 4660 5BEB.tmp 2900 5C39.tmp 4976 5C87.tmp 4956 5CD5.tmp 3328 5D33.tmp 2620 5D91.tmp 208 5DEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1524 1620 2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe 85 PID 1620 wrote to memory of 1524 1620 2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe 85 PID 1620 wrote to memory of 1524 1620 2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe 85 PID 1524 wrote to memory of 4896 1524 4805.tmp 86 PID 1524 wrote to memory of 4896 1524 4805.tmp 86 PID 1524 wrote to memory of 4896 1524 4805.tmp 86 PID 4896 wrote to memory of 1196 4896 4873.tmp 87 PID 4896 wrote to memory of 1196 4896 4873.tmp 87 PID 4896 wrote to memory of 1196 4896 4873.tmp 87 PID 1196 wrote to memory of 1068 1196 48D0.tmp 88 PID 1196 wrote to memory of 1068 1196 48D0.tmp 88 PID 1196 wrote to memory of 1068 1196 48D0.tmp 88 PID 1068 wrote to memory of 408 1068 493E.tmp 89 PID 1068 wrote to memory of 408 1068 493E.tmp 89 PID 1068 wrote to memory of 408 1068 493E.tmp 89 PID 408 wrote to memory of 4748 408 499C.tmp 90 PID 408 wrote to memory of 4748 408 499C.tmp 90 PID 408 wrote to memory of 4748 408 499C.tmp 90 PID 4748 wrote to memory of 4512 4748 4A09.tmp 91 PID 4748 wrote to memory of 4512 4748 4A09.tmp 91 PID 4748 wrote to memory of 4512 4748 4A09.tmp 91 PID 4512 wrote to memory of 2304 4512 4A76.tmp 92 PID 4512 wrote to memory of 2304 4512 4A76.tmp 92 PID 4512 wrote to memory of 2304 4512 4A76.tmp 92 PID 2304 wrote to memory of 3520 2304 4AD4.tmp 93 PID 2304 wrote to memory of 3520 2304 4AD4.tmp 93 PID 2304 wrote to memory of 3520 2304 4AD4.tmp 93 PID 3520 wrote to memory of 2068 3520 4B32.tmp 94 PID 3520 wrote to memory of 2068 3520 4B32.tmp 94 PID 3520 wrote to memory of 2068 3520 4B32.tmp 94 PID 2068 wrote to memory of 4724 2068 4B80.tmp 95 PID 2068 wrote to memory of 4724 2068 4B80.tmp 95 PID 2068 wrote to memory of 4724 2068 4B80.tmp 95 PID 4724 wrote to memory of 4700 4724 4BED.tmp 96 PID 4724 wrote to memory of 4700 4724 4BED.tmp 96 PID 4724 wrote to memory of 4700 4724 4BED.tmp 96 PID 4700 wrote to memory of 800 4700 4C3B.tmp 97 PID 4700 wrote to memory of 800 4700 4C3B.tmp 97 PID 4700 wrote to memory of 800 4700 4C3B.tmp 97 PID 800 wrote to memory of 3156 800 4CA9.tmp 98 PID 800 wrote to memory of 3156 800 4CA9.tmp 98 PID 800 wrote to memory of 3156 800 4CA9.tmp 98 PID 3156 wrote to memory of 4364 3156 4D07.tmp 99 PID 3156 wrote to memory of 4364 3156 4D07.tmp 99 PID 3156 wrote to memory of 4364 3156 4D07.tmp 99 PID 4364 wrote to memory of 2692 4364 4D55.tmp 100 PID 4364 wrote to memory of 2692 4364 4D55.tmp 100 PID 4364 wrote to memory of 2692 4364 4D55.tmp 100 PID 2692 wrote to memory of 3984 2692 4DB2.tmp 101 PID 2692 wrote to memory of 3984 2692 4DB2.tmp 101 PID 2692 wrote to memory of 3984 2692 4DB2.tmp 101 PID 3984 wrote to memory of 1924 3984 4E20.tmp 102 PID 3984 wrote to memory of 1924 3984 4E20.tmp 102 PID 3984 wrote to memory of 1924 3984 4E20.tmp 102 PID 1924 wrote to memory of 2788 1924 4E6E.tmp 103 PID 1924 wrote to memory of 2788 1924 4E6E.tmp 103 PID 1924 wrote to memory of 2788 1924 4E6E.tmp 103 PID 2788 wrote to memory of 2224 2788 4EBC.tmp 104 PID 2788 wrote to memory of 2224 2788 4EBC.tmp 104 PID 2788 wrote to memory of 2224 2788 4EBC.tmp 104 PID 2224 wrote to memory of 4460 2224 4F1A.tmp 105 PID 2224 wrote to memory of 4460 2224 4F1A.tmp 105 PID 2224 wrote to memory of 4460 2224 4F1A.tmp 105 PID 4460 wrote to memory of 2136 4460 4F68.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_fbf9076d3cfb6ff5d7331d5853daa2d1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"23⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"24⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"25⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"26⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"27⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"28⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"29⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"30⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"31⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"32⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"33⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"34⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"35⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"36⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"37⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"38⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"39⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"40⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"41⤵
- Executes dropped EXE
PID:328 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"42⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"43⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"44⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"45⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"46⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"47⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"48⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"49⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"50⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"51⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"52⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"53⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"54⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"55⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"56⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"57⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"58⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"59⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"60⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"61⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"62⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"63⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"64⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"65⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"66⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"67⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"68⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"69⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"70⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"71⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"72⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"73⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"75⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"76⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"77⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"78⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"79⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"80⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"81⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"82⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"83⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"84⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"85⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"86⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"87⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"88⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"89⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"90⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"91⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"92⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"93⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"94⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"95⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"96⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"97⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"98⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"99⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"100⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"101⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"103⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"105⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"106⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"107⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"108⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"109⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"110⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"111⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"112⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"113⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"114⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"115⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"116⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"117⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"118⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"119⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"120⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"121⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"122⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-