Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe
-
Size
765KB
-
MD5
fc0f43b8ff12cca92d734b69fa4a0766
-
SHA1
349935b083589c7d52b5e1d75371b08d5163bf1f
-
SHA256
75475ee161db65a2f5707587c0a39d87c5bec9d883d134c96c67992a901fbcb5
-
SHA512
d67365f6562a05e5544c73c6c12912cfcbde9e7bf2989a789ada3e320311e9dff148c478de567428e7bb2b3543fc56aa677089a657c03d63fa9e9499f80c111a
-
SSDEEP
12288:ZU5rCOTeiDLLR4xtqjz8slBhisCxtBWN3ZF5rn5rLOa54U5w5A:ZUQOJDLL6xti8slysQ7K3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
4C2C.tmp4CC8.tmp4D64.tmp4E20.tmp4EBC.tmp4F39.tmp4FA6.tmp5014.tmp5091.tmp511D.tmp518B.tmp5208.tmp5294.tmp5302.tmp537F.tmp53FC.tmp5479.tmp54F6.tmp5592.tmp561F.tmp56AB.tmp5728.tmp57A5.tmp5803.tmp5861.tmp58CE.tmp593C.tmp5999.tmp5A07.tmp5A93.tmp5B01.tmp5B6E.tmp5BFB.tmp5C49.tmp5C97.tmp5CF5.tmp5D43.tmp5DA1.tmp5DEF.tmp5E4C.tmp5E9B.tmp5EE9.tmp5F37.tmp5F95.tmp5FE3.tmp6040.tmp609E.tmp60FC.tmp614A.tmp61A8.tmp6206.tmp6254.tmp62A2.tmp6300.tmp634E.tmp63AB.tmp63FA.tmp6457.tmp64A5.tmp64F4.tmp6542.tmp659F.tmp65FD.tmp665B.tmppid process 3888 4C2C.tmp 2900 4CC8.tmp 2324 4D64.tmp 2912 4E20.tmp 2396 4EBC.tmp 1412 4F39.tmp 1064 4FA6.tmp 2940 5014.tmp 3932 5091.tmp 4244 511D.tmp 2540 518B.tmp 2880 5208.tmp 4716 5294.tmp 4440 5302.tmp 2764 537F.tmp 3108 53FC.tmp 608 5479.tmp 3220 54F6.tmp 4328 5592.tmp 448 561F.tmp 1748 56AB.tmp 1552 5728.tmp 1932 57A5.tmp 1604 5803.tmp 3620 5861.tmp 4284 58CE.tmp 4488 593C.tmp 1092 5999.tmp 744 5A07.tmp 4600 5A93.tmp 1204 5B01.tmp 4208 5B6E.tmp 2900 5BFB.tmp 1468 5C49.tmp 2488 5C97.tmp 2812 5CF5.tmp 2912 5D43.tmp 3508 5DA1.tmp 2860 5DEF.tmp 4504 5E4C.tmp 1240 5E9B.tmp 2532 5EE9.tmp 4452 5F37.tmp 5052 5F95.tmp 1868 5FE3.tmp 3516 6040.tmp 1124 609E.tmp 3248 60FC.tmp 2332 614A.tmp 2880 61A8.tmp 3988 6206.tmp 4936 6254.tmp 3316 62A2.tmp 2752 6300.tmp 4184 634E.tmp 1096 63AB.tmp 608 63FA.tmp 2164 6457.tmp 4444 64A5.tmp 3364 64F4.tmp 448 6542.tmp 3192 659F.tmp 2836 65FD.tmp 3140 665B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe4C2C.tmp4CC8.tmp4D64.tmp4E20.tmp4EBC.tmp4F39.tmp4FA6.tmp5014.tmp5091.tmp511D.tmp518B.tmp5208.tmp5294.tmp5302.tmp537F.tmp53FC.tmp5479.tmp54F6.tmp5592.tmp561F.tmp56AB.tmpdescription pid process target process PID 2108 wrote to memory of 3888 2108 2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe 4C2C.tmp PID 2108 wrote to memory of 3888 2108 2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe 4C2C.tmp PID 2108 wrote to memory of 3888 2108 2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe 4C2C.tmp PID 3888 wrote to memory of 2900 3888 4C2C.tmp 4CC8.tmp PID 3888 wrote to memory of 2900 3888 4C2C.tmp 4CC8.tmp PID 3888 wrote to memory of 2900 3888 4C2C.tmp 4CC8.tmp PID 2900 wrote to memory of 2324 2900 4CC8.tmp 4D64.tmp PID 2900 wrote to memory of 2324 2900 4CC8.tmp 4D64.tmp PID 2900 wrote to memory of 2324 2900 4CC8.tmp 4D64.tmp PID 2324 wrote to memory of 2912 2324 4D64.tmp 4E20.tmp PID 2324 wrote to memory of 2912 2324 4D64.tmp 4E20.tmp PID 2324 wrote to memory of 2912 2324 4D64.tmp 4E20.tmp PID 2912 wrote to memory of 2396 2912 4E20.tmp 4EBC.tmp PID 2912 wrote to memory of 2396 2912 4E20.tmp 4EBC.tmp PID 2912 wrote to memory of 2396 2912 4E20.tmp 4EBC.tmp PID 2396 wrote to memory of 1412 2396 4EBC.tmp 4F39.tmp PID 2396 wrote to memory of 1412 2396 4EBC.tmp 4F39.tmp PID 2396 wrote to memory of 1412 2396 4EBC.tmp 4F39.tmp PID 1412 wrote to memory of 1064 1412 4F39.tmp 4FA6.tmp PID 1412 wrote to memory of 1064 1412 4F39.tmp 4FA6.tmp PID 1412 wrote to memory of 1064 1412 4F39.tmp 4FA6.tmp PID 1064 wrote to memory of 2940 1064 4FA6.tmp 5014.tmp PID 1064 wrote to memory of 2940 1064 4FA6.tmp 5014.tmp PID 1064 wrote to memory of 2940 1064 4FA6.tmp 5014.tmp PID 2940 wrote to memory of 3932 2940 5014.tmp 5091.tmp PID 2940 wrote to memory of 3932 2940 5014.tmp 5091.tmp PID 2940 wrote to memory of 3932 2940 5014.tmp 5091.tmp PID 3932 wrote to memory of 4244 3932 5091.tmp 511D.tmp PID 3932 wrote to memory of 4244 3932 5091.tmp 511D.tmp PID 3932 wrote to memory of 4244 3932 5091.tmp 511D.tmp PID 4244 wrote to memory of 2540 4244 511D.tmp 518B.tmp PID 4244 wrote to memory of 2540 4244 511D.tmp 518B.tmp PID 4244 wrote to memory of 2540 4244 511D.tmp 518B.tmp PID 2540 wrote to memory of 2880 2540 518B.tmp 5208.tmp PID 2540 wrote to memory of 2880 2540 518B.tmp 5208.tmp PID 2540 wrote to memory of 2880 2540 518B.tmp 5208.tmp PID 2880 wrote to memory of 4716 2880 5208.tmp 5294.tmp PID 2880 wrote to memory of 4716 2880 5208.tmp 5294.tmp PID 2880 wrote to memory of 4716 2880 5208.tmp 5294.tmp PID 4716 wrote to memory of 4440 4716 5294.tmp 5302.tmp PID 4716 wrote to memory of 4440 4716 5294.tmp 5302.tmp PID 4716 wrote to memory of 4440 4716 5294.tmp 5302.tmp PID 4440 wrote to memory of 2764 4440 5302.tmp 537F.tmp PID 4440 wrote to memory of 2764 4440 5302.tmp 537F.tmp PID 4440 wrote to memory of 2764 4440 5302.tmp 537F.tmp PID 2764 wrote to memory of 3108 2764 537F.tmp 53FC.tmp PID 2764 wrote to memory of 3108 2764 537F.tmp 53FC.tmp PID 2764 wrote to memory of 3108 2764 537F.tmp 53FC.tmp PID 3108 wrote to memory of 608 3108 53FC.tmp 5479.tmp PID 3108 wrote to memory of 608 3108 53FC.tmp 5479.tmp PID 3108 wrote to memory of 608 3108 53FC.tmp 5479.tmp PID 608 wrote to memory of 3220 608 5479.tmp 54F6.tmp PID 608 wrote to memory of 3220 608 5479.tmp 54F6.tmp PID 608 wrote to memory of 3220 608 5479.tmp 54F6.tmp PID 3220 wrote to memory of 4328 3220 54F6.tmp 5592.tmp PID 3220 wrote to memory of 4328 3220 54F6.tmp 5592.tmp PID 3220 wrote to memory of 4328 3220 54F6.tmp 5592.tmp PID 4328 wrote to memory of 448 4328 5592.tmp 561F.tmp PID 4328 wrote to memory of 448 4328 5592.tmp 561F.tmp PID 4328 wrote to memory of 448 4328 5592.tmp 561F.tmp PID 448 wrote to memory of 1748 448 561F.tmp 56AB.tmp PID 448 wrote to memory of 1748 448 561F.tmp 56AB.tmp PID 448 wrote to memory of 1748 448 561F.tmp 56AB.tmp PID 1748 wrote to memory of 1552 1748 56AB.tmp 5728.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_fc0f43b8ff12cca92d734b69fa4a0766_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"23⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"24⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"25⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"26⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"27⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"28⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"29⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"30⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"31⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"32⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"33⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"34⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"35⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"36⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"37⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"38⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"39⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"40⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"41⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"42⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"43⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"44⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"45⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"46⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"47⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"48⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"49⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"50⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"51⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"52⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"53⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"54⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"55⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"56⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"57⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"58⤵
- Executes dropped EXE
PID:608 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"59⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"60⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"61⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"62⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"63⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"64⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"65⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"66⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"67⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"68⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"69⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"70⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"71⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"72⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"73⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"74⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"75⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"76⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"78⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"79⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"80⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"81⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"82⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"84⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"85⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"86⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"87⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"88⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"89⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"90⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"91⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"92⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"93⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"94⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"95⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"96⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"97⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"98⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"99⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"101⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"102⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"103⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"104⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"106⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"107⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"108⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"109⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"110⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"111⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"112⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"113⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"114⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"115⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"116⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"117⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"118⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"119⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"120⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"121⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"122⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-