Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe
-
Size
486KB
-
MD5
879d9aa09d74cf8f14b9fedbe9109f42
-
SHA1
85265ad5b15c9f875cdbf588f01bf7da2accda33
-
SHA256
9a65404295118657f807974c69cad5f86ed411bb37044fd6d124fc0c52e48d2b
-
SHA512
cc87e33d93f78469cc712411557fd798e48aeac5802ba6664e2916d71c4f2620b636acfb7fbe57942949d1845cc13f012b9596b25930b772d808957026106697
-
SSDEEP
12288:UU5rCOTeiDKcp/TO5zzfU5gYAcN2jjqc7NZ:UUQOJDHhS5vUeYA+4jD7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4664 4D55.tmp 4796 4DB2.tmp 4160 4E2F.tmp 1136 4E9D.tmp 4860 4F29.tmp 916 4F87.tmp 3884 4FF5.tmp 548 5062.tmp 3128 50C0.tmp 5084 513D.tmp 3872 51AA.tmp 2408 5208.tmp 4416 5285.tmp 4576 52F2.tmp 1500 5350.tmp 1452 53DD.tmp 4808 544A.tmp 3544 54C7.tmp 1388 5515.tmp 3180 5573.tmp 860 55E0.tmp 996 562E.tmp 1284 56BB.tmp 3540 5738.tmp 1824 57A5.tmp 3076 5813.tmp 3260 5861.tmp 4496 58BF.tmp 1000 593C.tmp 3356 59B9.tmp 1860 5A16.tmp 2484 5A93.tmp 3452 5B10.tmp 8 5B5E.tmp 1504 5BBC.tmp 4460 5C1A.tmp 1604 5C68.tmp 2116 5CB6.tmp 1268 5D14.tmp 4552 5D72.tmp 4268 5DC0.tmp 4860 5E1E.tmp 3060 5E7B.tmp 676 5ED9.tmp 956 5F27.tmp 4816 5F85.tmp 2028 5FD3.tmp 548 6031.tmp 2148 608F.tmp 5048 60EC.tmp 4472 614A.tmp 2644 61A8.tmp 4696 6206.tmp 4580 6263.tmp 4972 62C1.tmp 3904 631F.tmp 1288 637D.tmp 1432 63CB.tmp 4556 6419.tmp 1436 6477.tmp 2540 64C5.tmp 4200 6522.tmp 404 6580.tmp 3932 65CE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 4664 2860 2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe 83 PID 2860 wrote to memory of 4664 2860 2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe 83 PID 2860 wrote to memory of 4664 2860 2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe 83 PID 4664 wrote to memory of 4796 4664 4D55.tmp 84 PID 4664 wrote to memory of 4796 4664 4D55.tmp 84 PID 4664 wrote to memory of 4796 4664 4D55.tmp 84 PID 4796 wrote to memory of 4160 4796 4DB2.tmp 85 PID 4796 wrote to memory of 4160 4796 4DB2.tmp 85 PID 4796 wrote to memory of 4160 4796 4DB2.tmp 85 PID 4160 wrote to memory of 1136 4160 4E2F.tmp 87 PID 4160 wrote to memory of 1136 4160 4E2F.tmp 87 PID 4160 wrote to memory of 1136 4160 4E2F.tmp 87 PID 1136 wrote to memory of 4860 1136 4E9D.tmp 89 PID 1136 wrote to memory of 4860 1136 4E9D.tmp 89 PID 1136 wrote to memory of 4860 1136 4E9D.tmp 89 PID 4860 wrote to memory of 916 4860 4F29.tmp 90 PID 4860 wrote to memory of 916 4860 4F29.tmp 90 PID 4860 wrote to memory of 916 4860 4F29.tmp 90 PID 916 wrote to memory of 3884 916 4F87.tmp 92 PID 916 wrote to memory of 3884 916 4F87.tmp 92 PID 916 wrote to memory of 3884 916 4F87.tmp 92 PID 3884 wrote to memory of 548 3884 4FF5.tmp 93 PID 3884 wrote to memory of 548 3884 4FF5.tmp 93 PID 3884 wrote to memory of 548 3884 4FF5.tmp 93 PID 548 wrote to memory of 3128 548 5062.tmp 94 PID 548 wrote to memory of 3128 548 5062.tmp 94 PID 548 wrote to memory of 3128 548 5062.tmp 94 PID 3128 wrote to memory of 5084 3128 50C0.tmp 95 PID 3128 wrote to memory of 5084 3128 50C0.tmp 95 PID 3128 wrote to memory of 5084 3128 50C0.tmp 95 PID 5084 wrote to memory of 3872 5084 513D.tmp 96 PID 5084 wrote to memory of 3872 5084 513D.tmp 96 PID 5084 wrote to memory of 3872 5084 513D.tmp 96 PID 3872 wrote to memory of 2408 3872 51AA.tmp 97 PID 3872 wrote to memory of 2408 3872 51AA.tmp 97 PID 3872 wrote to memory of 2408 3872 51AA.tmp 97 PID 2408 wrote to memory of 4416 2408 5208.tmp 98 PID 2408 wrote to memory of 4416 2408 5208.tmp 98 PID 2408 wrote to memory of 4416 2408 5208.tmp 98 PID 4416 wrote to memory of 4576 4416 5285.tmp 99 PID 4416 wrote to memory of 4576 4416 5285.tmp 99 PID 4416 wrote to memory of 4576 4416 5285.tmp 99 PID 4576 wrote to memory of 1500 4576 52F2.tmp 100 PID 4576 wrote to memory of 1500 4576 52F2.tmp 100 PID 4576 wrote to memory of 1500 4576 52F2.tmp 100 PID 1500 wrote to memory of 1452 1500 5350.tmp 101 PID 1500 wrote to memory of 1452 1500 5350.tmp 101 PID 1500 wrote to memory of 1452 1500 5350.tmp 101 PID 1452 wrote to memory of 4808 1452 53DD.tmp 102 PID 1452 wrote to memory of 4808 1452 53DD.tmp 102 PID 1452 wrote to memory of 4808 1452 53DD.tmp 102 PID 4808 wrote to memory of 3544 4808 544A.tmp 103 PID 4808 wrote to memory of 3544 4808 544A.tmp 103 PID 4808 wrote to memory of 3544 4808 544A.tmp 103 PID 3544 wrote to memory of 1388 3544 54C7.tmp 105 PID 3544 wrote to memory of 1388 3544 54C7.tmp 105 PID 3544 wrote to memory of 1388 3544 54C7.tmp 105 PID 1388 wrote to memory of 3180 1388 5515.tmp 106 PID 1388 wrote to memory of 3180 1388 5515.tmp 106 PID 1388 wrote to memory of 3180 1388 5515.tmp 106 PID 3180 wrote to memory of 860 3180 5573.tmp 107 PID 3180 wrote to memory of 860 3180 5573.tmp 107 PID 3180 wrote to memory of 860 3180 5573.tmp 107 PID 860 wrote to memory of 996 860 55E0.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_879d9aa09d74cf8f14b9fedbe9109f42_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"23⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"24⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"25⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"26⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"27⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"28⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"29⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"30⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"31⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"32⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"33⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"34⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"35⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"36⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"37⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"38⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"39⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"40⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"41⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"42⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"43⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"44⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"45⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"46⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"47⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"48⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"49⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"50⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"51⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"53⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"54⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"55⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"56⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"57⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"58⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"59⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"60⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"61⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"62⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"63⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"64⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"65⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"66⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"67⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"68⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"69⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"70⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"71⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"72⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"73⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"74⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"75⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"76⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"77⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"78⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"79⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"80⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"81⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"82⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"83⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"84⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"85⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"86⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"87⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"88⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"89⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"90⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"91⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"93⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"94⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"95⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"96⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"97⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"98⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"99⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"100⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"101⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"102⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"103⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"104⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"105⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"106⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"107⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"108⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"109⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"110⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"111⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"112⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"113⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"114⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"115⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"116⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"117⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"118⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"119⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"120⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"121⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"122⤵PID:860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-