Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe
-
Size
536KB
-
MD5
fe63ecc712a4d8d5fcf0fdd0a10a9bdd
-
SHA1
a9ace5a216cb01bc38fe9fd12f41616c4d08ff87
-
SHA256
9a9cad9e0bc99fc782599423468f6593fc85a46a29724d9d901ea8893317afa5
-
SHA512
9428784c1ef83e4a54ca658b5f46149c731e560c09b46db051f917c23b4ef27f4dbeecbd55bd93e533edc5600d173e0287ff476833877dc4b0812989d04fd747
-
SSDEEP
12288:wU5rCOTeiUI/F9OWqxeiIkjiOLh5jOmSIZxVJ0ZT9:wUQOJUIHOWqxikOOLhdOmSIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4512 43CF.tmp 2412 445C.tmp 2728 44D9.tmp 2776 4575.tmp 5024 4611.tmp 4428 46BD.tmp 888 474A.tmp 3660 47F6.tmp 1992 4863.tmp 2332 48D0.tmp 2052 496D.tmp 2272 49EA.tmp 3664 4AA5.tmp 3232 4B51.tmp 2652 4BCE.tmp 2240 4C6A.tmp 2196 4D26.tmp 2684 4DE1.tmp 2104 4E8D.tmp 2012 4F1A.tmp 1800 4FA6.tmp 2884 5033.tmp 3456 50C0.tmp 396 516C.tmp 4496 5208.tmp 3672 5294.tmp 4908 5331.tmp 4896 53CD.tmp 4432 544A.tmp 1536 54D7.tmp 4612 5554.tmp 2940 55F0.tmp 4156 568C.tmp 4892 5709.tmp 3100 5786.tmp 3768 57F3.tmp 4488 5842.tmp 4480 589F.tmp 2332 590D.tmp 1560 597A.tmp 208 59D8.tmp 3120 5A45.tmp 2244 5AB3.tmp 2240 5B10.tmp 2868 5B6E.tmp 1396 5BCC.tmp 4556 5C39.tmp 4568 5C97.tmp 904 5CF5.tmp 2012 5D43.tmp 3564 5D91.tmp 3480 5DDF.tmp 880 5E2D.tmp 3456 5E7B.tmp 1820 5EC9.tmp 684 5F27.tmp 4960 5F75.tmp 5036 5FD3.tmp 4584 6021.tmp 4544 606F.tmp 5088 60BD.tmp 1536 610C.tmp 3500 615A.tmp 824 61A8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 4512 2420 2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe 87 PID 2420 wrote to memory of 4512 2420 2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe 87 PID 2420 wrote to memory of 4512 2420 2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe 87 PID 4512 wrote to memory of 2412 4512 43CF.tmp 88 PID 4512 wrote to memory of 2412 4512 43CF.tmp 88 PID 4512 wrote to memory of 2412 4512 43CF.tmp 88 PID 2412 wrote to memory of 2728 2412 445C.tmp 89 PID 2412 wrote to memory of 2728 2412 445C.tmp 89 PID 2412 wrote to memory of 2728 2412 445C.tmp 89 PID 2728 wrote to memory of 2776 2728 44D9.tmp 90 PID 2728 wrote to memory of 2776 2728 44D9.tmp 90 PID 2728 wrote to memory of 2776 2728 44D9.tmp 90 PID 2776 wrote to memory of 5024 2776 4575.tmp 91 PID 2776 wrote to memory of 5024 2776 4575.tmp 91 PID 2776 wrote to memory of 5024 2776 4575.tmp 91 PID 5024 wrote to memory of 4428 5024 4611.tmp 93 PID 5024 wrote to memory of 4428 5024 4611.tmp 93 PID 5024 wrote to memory of 4428 5024 4611.tmp 93 PID 4428 wrote to memory of 888 4428 46BD.tmp 95 PID 4428 wrote to memory of 888 4428 46BD.tmp 95 PID 4428 wrote to memory of 888 4428 46BD.tmp 95 PID 888 wrote to memory of 3660 888 474A.tmp 96 PID 888 wrote to memory of 3660 888 474A.tmp 96 PID 888 wrote to memory of 3660 888 474A.tmp 96 PID 3660 wrote to memory of 1992 3660 47F6.tmp 98 PID 3660 wrote to memory of 1992 3660 47F6.tmp 98 PID 3660 wrote to memory of 1992 3660 47F6.tmp 98 PID 1992 wrote to memory of 2332 1992 4863.tmp 99 PID 1992 wrote to memory of 2332 1992 4863.tmp 99 PID 1992 wrote to memory of 2332 1992 4863.tmp 99 PID 2332 wrote to memory of 2052 2332 48D0.tmp 100 PID 2332 wrote to memory of 2052 2332 48D0.tmp 100 PID 2332 wrote to memory of 2052 2332 48D0.tmp 100 PID 2052 wrote to memory of 2272 2052 496D.tmp 101 PID 2052 wrote to memory of 2272 2052 496D.tmp 101 PID 2052 wrote to memory of 2272 2052 496D.tmp 101 PID 2272 wrote to memory of 3664 2272 49EA.tmp 102 PID 2272 wrote to memory of 3664 2272 49EA.tmp 102 PID 2272 wrote to memory of 3664 2272 49EA.tmp 102 PID 3664 wrote to memory of 3232 3664 4AA5.tmp 103 PID 3664 wrote to memory of 3232 3664 4AA5.tmp 103 PID 3664 wrote to memory of 3232 3664 4AA5.tmp 103 PID 3232 wrote to memory of 2652 3232 4B51.tmp 104 PID 3232 wrote to memory of 2652 3232 4B51.tmp 104 PID 3232 wrote to memory of 2652 3232 4B51.tmp 104 PID 2652 wrote to memory of 2240 2652 4BCE.tmp 105 PID 2652 wrote to memory of 2240 2652 4BCE.tmp 105 PID 2652 wrote to memory of 2240 2652 4BCE.tmp 105 PID 2240 wrote to memory of 2196 2240 4C6A.tmp 106 PID 2240 wrote to memory of 2196 2240 4C6A.tmp 106 PID 2240 wrote to memory of 2196 2240 4C6A.tmp 106 PID 2196 wrote to memory of 2684 2196 4D26.tmp 107 PID 2196 wrote to memory of 2684 2196 4D26.tmp 107 PID 2196 wrote to memory of 2684 2196 4D26.tmp 107 PID 2684 wrote to memory of 2104 2684 4DE1.tmp 108 PID 2684 wrote to memory of 2104 2684 4DE1.tmp 108 PID 2684 wrote to memory of 2104 2684 4DE1.tmp 108 PID 2104 wrote to memory of 2012 2104 4E8D.tmp 109 PID 2104 wrote to memory of 2012 2104 4E8D.tmp 109 PID 2104 wrote to memory of 2012 2104 4E8D.tmp 109 PID 2012 wrote to memory of 1800 2012 4F1A.tmp 110 PID 2012 wrote to memory of 1800 2012 4F1A.tmp 110 PID 2012 wrote to memory of 1800 2012 4F1A.tmp 110 PID 1800 wrote to memory of 2884 1800 4FA6.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_fe63ecc712a4d8d5fcf0fdd0a10a9bdd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"23⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"24⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"25⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"26⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"27⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"28⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"29⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"30⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"31⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"32⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"33⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"34⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"35⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"36⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"37⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"38⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"39⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"40⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"41⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"42⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"43⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"44⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"45⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"46⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"47⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"48⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"49⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"50⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"51⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"52⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"53⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"54⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"55⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"56⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"57⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"58⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"59⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"60⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"61⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"62⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"63⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"64⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"65⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"66⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"67⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"68⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"69⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"70⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"71⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"72⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"73⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"74⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"75⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"76⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"77⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"78⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"79⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"80⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"82⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"83⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"84⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"85⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"86⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"88⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"89⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"90⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"91⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"92⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"93⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"94⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"95⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"96⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"98⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"99⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"100⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"101⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"102⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"103⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"104⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"105⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"106⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"107⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"108⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"109⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"110⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"111⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"112⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"113⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"114⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"115⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"116⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"117⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"118⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"119⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"120⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"121⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-