Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
-
Size
520KB
-
MD5
9c93fdafecb97d120af49516181c9a74
-
SHA1
bf33dd543e2af6f09f07d0e05d7cc522640627b5
-
SHA256
beeff0ce4307e6284bd33a6a3ba56d2fa42b8c71eaf50c508cef01f15ee7e68b
-
SHA512
ed778e54620f28754b882cca0349a4559975f97e91ef393db9bb31e58b1de71f78fdfb91e3a9524339c60271eea95f22a54d6e3952bcb643f642e00aac820faf
-
SSDEEP
12288:gj8fuxR21t5i8fLh1NFvhGN8NOoU04hsmTk69KCdkxfNZ:gj8fuK1GYLhdVNOp0CJ3EN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4636 49BB.tmp 3044 4A57.tmp 2180 4AB5.tmp 556 4B32.tmp 3256 4B9F.tmp 628 4C1C.tmp 1900 4C99.tmp 3932 4D16.tmp 2584 4DA3.tmp 1372 4E01.tmp 4880 4E4F.tmp 808 4E9D.tmp 4200 4EFB.tmp 2532 4F87.tmp 2164 4FF5.tmp 4464 5062.tmp 856 50DF.tmp 1784 516C.tmp 2376 51C9.tmp 2896 5227.tmp 1520 5294.tmp 2068 52E3.tmp 3116 5340.tmp 2140 539E.tmp 1060 53EC.tmp 4208 545A.tmp 1236 54A8.tmp 632 5505.tmp 2256 5563.tmp 4584 55D1.tmp 5024 561F.tmp 2464 567C.tmp 2560 56F9.tmp 4852 5757.tmp 4388 57A5.tmp 3492 5803.tmp 3128 5851.tmp 3608 58AF.tmp 4376 590D.tmp 2596 595B.tmp 4300 59B9.tmp 4324 5A16.tmp 404 5A74.tmp 4304 5AC2.tmp 1600 5B10.tmp 1800 5B5E.tmp 4492 5BAD.tmp 4700 5C0A.tmp 2780 5C58.tmp 2508 5CB6.tmp 836 5D04.tmp 4092 5D52.tmp 1936 5DB0.tmp 4992 5E0E.tmp 2776 5E6C.tmp 1792 5EC9.tmp 760 5F27.tmp 4568 5F95.tmp 1876 5FF2.tmp 1512 6050.tmp 3528 60AE.tmp 3644 610C.tmp 4724 6169.tmp 4108 61C7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 404 wrote to memory of 4636 404 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 82 PID 404 wrote to memory of 4636 404 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 82 PID 404 wrote to memory of 4636 404 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 82 PID 4636 wrote to memory of 3044 4636 49BB.tmp 83 PID 4636 wrote to memory of 3044 4636 49BB.tmp 83 PID 4636 wrote to memory of 3044 4636 49BB.tmp 83 PID 3044 wrote to memory of 2180 3044 4A57.tmp 84 PID 3044 wrote to memory of 2180 3044 4A57.tmp 84 PID 3044 wrote to memory of 2180 3044 4A57.tmp 84 PID 2180 wrote to memory of 556 2180 4AB5.tmp 85 PID 2180 wrote to memory of 556 2180 4AB5.tmp 85 PID 2180 wrote to memory of 556 2180 4AB5.tmp 85 PID 556 wrote to memory of 3256 556 4B32.tmp 86 PID 556 wrote to memory of 3256 556 4B32.tmp 86 PID 556 wrote to memory of 3256 556 4B32.tmp 86 PID 3256 wrote to memory of 628 3256 4B9F.tmp 87 PID 3256 wrote to memory of 628 3256 4B9F.tmp 87 PID 3256 wrote to memory of 628 3256 4B9F.tmp 87 PID 628 wrote to memory of 1900 628 4C1C.tmp 89 PID 628 wrote to memory of 1900 628 4C1C.tmp 89 PID 628 wrote to memory of 1900 628 4C1C.tmp 89 PID 1900 wrote to memory of 3932 1900 4C99.tmp 91 PID 1900 wrote to memory of 3932 1900 4C99.tmp 91 PID 1900 wrote to memory of 3932 1900 4C99.tmp 91 PID 3932 wrote to memory of 2584 3932 4D16.tmp 93 PID 3932 wrote to memory of 2584 3932 4D16.tmp 93 PID 3932 wrote to memory of 2584 3932 4D16.tmp 93 PID 2584 wrote to memory of 1372 2584 4DA3.tmp 94 PID 2584 wrote to memory of 1372 2584 4DA3.tmp 94 PID 2584 wrote to memory of 1372 2584 4DA3.tmp 94 PID 1372 wrote to memory of 4880 1372 4E01.tmp 95 PID 1372 wrote to memory of 4880 1372 4E01.tmp 95 PID 1372 wrote to memory of 4880 1372 4E01.tmp 95 PID 4880 wrote to memory of 808 4880 4E4F.tmp 96 PID 4880 wrote to memory of 808 4880 4E4F.tmp 96 PID 4880 wrote to memory of 808 4880 4E4F.tmp 96 PID 808 wrote to memory of 4200 808 4E9D.tmp 97 PID 808 wrote to memory of 4200 808 4E9D.tmp 97 PID 808 wrote to memory of 4200 808 4E9D.tmp 97 PID 4200 wrote to memory of 2532 4200 4EFB.tmp 98 PID 4200 wrote to memory of 2532 4200 4EFB.tmp 98 PID 4200 wrote to memory of 2532 4200 4EFB.tmp 98 PID 2532 wrote to memory of 2164 2532 4F87.tmp 99 PID 2532 wrote to memory of 2164 2532 4F87.tmp 99 PID 2532 wrote to memory of 2164 2532 4F87.tmp 99 PID 2164 wrote to memory of 4464 2164 4FF5.tmp 100 PID 2164 wrote to memory of 4464 2164 4FF5.tmp 100 PID 2164 wrote to memory of 4464 2164 4FF5.tmp 100 PID 4464 wrote to memory of 856 4464 5062.tmp 101 PID 4464 wrote to memory of 856 4464 5062.tmp 101 PID 4464 wrote to memory of 856 4464 5062.tmp 101 PID 856 wrote to memory of 1784 856 50DF.tmp 102 PID 856 wrote to memory of 1784 856 50DF.tmp 102 PID 856 wrote to memory of 1784 856 50DF.tmp 102 PID 1784 wrote to memory of 2376 1784 516C.tmp 103 PID 1784 wrote to memory of 2376 1784 516C.tmp 103 PID 1784 wrote to memory of 2376 1784 516C.tmp 103 PID 2376 wrote to memory of 2896 2376 51C9.tmp 104 PID 2376 wrote to memory of 2896 2376 51C9.tmp 104 PID 2376 wrote to memory of 2896 2376 51C9.tmp 104 PID 2896 wrote to memory of 1520 2896 5227.tmp 105 PID 2896 wrote to memory of 1520 2896 5227.tmp 105 PID 2896 wrote to memory of 1520 2896 5227.tmp 105 PID 1520 wrote to memory of 2068 1520 5294.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"23⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"24⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"25⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"26⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"27⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"28⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"29⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"30⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"31⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"32⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"33⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"34⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"35⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"36⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"37⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"38⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"39⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"40⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"41⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"42⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"43⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"44⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"45⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"46⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"47⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"48⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"49⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"50⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"51⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"52⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"53⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"54⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"55⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"56⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"57⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"58⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"59⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"60⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"61⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"62⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"63⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"64⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"65⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"66⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"67⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"68⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"69⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"70⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"71⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"72⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"73⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"74⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"75⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"76⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"77⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"78⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"79⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"81⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"82⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"83⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"84⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"85⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"86⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"87⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"88⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"89⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"90⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"91⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"92⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"93⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"95⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"96⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"97⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"98⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"99⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"100⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"101⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"102⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"103⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"104⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"105⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"106⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"107⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"108⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"109⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"110⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"111⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"112⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"113⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"114⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"115⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"116⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"117⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"119⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"120⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"121⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"122⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-