Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
-
Size
487KB
-
MD5
86ee2f0704d08e26f12f68b54a4219c1
-
SHA1
10847116aeb4d749738e6fa7dff425a6b798b4b9
-
SHA256
b9a167736ba362dd480ba786e1759d0f18a062b75d51bd3893ce66fe63bea6f8
-
SHA512
0ed7aae3c7b7108828dd68da79c71f7195d18e44c8d1e00037a9590b7193d7d91aed809427709369af19f4914a3ebd8ed5684a2bfd3dfc55f9758d0a290e08c9
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUk7eRDmuv9ba2psJkNgd91o8c4Mwmcw/w7nar:HU5rCOTeiJCtsENNq923wh7na0liNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3760 4863.tmp 4160 48E0.tmp 4288 495D.tmp 4404 49DA.tmp 4864 4A38.tmp 3376 4AA5.tmp 3220 4B22.tmp 3900 4B90.tmp 4260 4BFD.tmp 4980 4C5B.tmp 2096 4CB8.tmp 2404 4D84.tmp 3772 4E10.tmp 1324 4E6E.tmp 4152 4F0A.tmp 2444 4F78.tmp 2816 4FC6.tmp 1876 5023.tmp 1472 5091.tmp 3444 50EF.tmp 2104 515C.tmp 4820 51BA.tmp 668 5217.tmp 1888 5294.tmp 1028 5302.tmp 3420 537F.tmp 4440 540B.tmp 5072 5498.tmp 4016 54F6.tmp 4904 5592.tmp 1840 560F.tmp 1984 566D.tmp 4752 56BB.tmp 4632 5719.tmp 4924 5776.tmp 1996 57C5.tmp 4088 5813.tmp 2924 5861.tmp 4492 58AF.tmp 4640 590D.tmp 2484 596A.tmp 744 59C8.tmp 4724 5A26.tmp 2400 5A84.tmp 2708 5AD2.tmp 3612 5B3F.tmp 1508 5B9D.tmp 4912 5BFB.tmp 3704 5C49.tmp 208 5CA7.tmp 3920 5D04.tmp 3040 5D62.tmp 3300 5DC0.tmp 440 5E1E.tmp 4380 5E6C.tmp 1836 5EC9.tmp 4172 5F37.tmp 3376 5F95.tmp 540 5FF2.tmp 4272 6050.tmp 4532 60AE.tmp 5016 610C.tmp 3408 6169.tmp 4348 61C7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3760 2552 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 82 PID 2552 wrote to memory of 3760 2552 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 82 PID 2552 wrote to memory of 3760 2552 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 82 PID 3760 wrote to memory of 4160 3760 4863.tmp 83 PID 3760 wrote to memory of 4160 3760 4863.tmp 83 PID 3760 wrote to memory of 4160 3760 4863.tmp 83 PID 4160 wrote to memory of 4288 4160 48E0.tmp 85 PID 4160 wrote to memory of 4288 4160 48E0.tmp 85 PID 4160 wrote to memory of 4288 4160 48E0.tmp 85 PID 4288 wrote to memory of 4404 4288 495D.tmp 86 PID 4288 wrote to memory of 4404 4288 495D.tmp 86 PID 4288 wrote to memory of 4404 4288 495D.tmp 86 PID 4404 wrote to memory of 4864 4404 49DA.tmp 88 PID 4404 wrote to memory of 4864 4404 49DA.tmp 88 PID 4404 wrote to memory of 4864 4404 49DA.tmp 88 PID 4864 wrote to memory of 3376 4864 4A38.tmp 89 PID 4864 wrote to memory of 3376 4864 4A38.tmp 89 PID 4864 wrote to memory of 3376 4864 4A38.tmp 89 PID 3376 wrote to memory of 3220 3376 4AA5.tmp 90 PID 3376 wrote to memory of 3220 3376 4AA5.tmp 90 PID 3376 wrote to memory of 3220 3376 4AA5.tmp 90 PID 3220 wrote to memory of 3900 3220 4B22.tmp 92 PID 3220 wrote to memory of 3900 3220 4B22.tmp 92 PID 3220 wrote to memory of 3900 3220 4B22.tmp 92 PID 3900 wrote to memory of 4260 3900 4B90.tmp 93 PID 3900 wrote to memory of 4260 3900 4B90.tmp 93 PID 3900 wrote to memory of 4260 3900 4B90.tmp 93 PID 4260 wrote to memory of 4980 4260 4BFD.tmp 94 PID 4260 wrote to memory of 4980 4260 4BFD.tmp 94 PID 4260 wrote to memory of 4980 4260 4BFD.tmp 94 PID 4980 wrote to memory of 2096 4980 4C5B.tmp 95 PID 4980 wrote to memory of 2096 4980 4C5B.tmp 95 PID 4980 wrote to memory of 2096 4980 4C5B.tmp 95 PID 2096 wrote to memory of 2404 2096 4CB8.tmp 96 PID 2096 wrote to memory of 2404 2096 4CB8.tmp 96 PID 2096 wrote to memory of 2404 2096 4CB8.tmp 96 PID 2404 wrote to memory of 3772 2404 4D84.tmp 97 PID 2404 wrote to memory of 3772 2404 4D84.tmp 97 PID 2404 wrote to memory of 3772 2404 4D84.tmp 97 PID 3772 wrote to memory of 1324 3772 4E10.tmp 98 PID 3772 wrote to memory of 1324 3772 4E10.tmp 98 PID 3772 wrote to memory of 1324 3772 4E10.tmp 98 PID 1324 wrote to memory of 4152 1324 4E6E.tmp 99 PID 1324 wrote to memory of 4152 1324 4E6E.tmp 99 PID 1324 wrote to memory of 4152 1324 4E6E.tmp 99 PID 4152 wrote to memory of 2444 4152 4F0A.tmp 100 PID 4152 wrote to memory of 2444 4152 4F0A.tmp 100 PID 4152 wrote to memory of 2444 4152 4F0A.tmp 100 PID 2444 wrote to memory of 2816 2444 4F78.tmp 101 PID 2444 wrote to memory of 2816 2444 4F78.tmp 101 PID 2444 wrote to memory of 2816 2444 4F78.tmp 101 PID 2816 wrote to memory of 1876 2816 4FC6.tmp 102 PID 2816 wrote to memory of 1876 2816 4FC6.tmp 102 PID 2816 wrote to memory of 1876 2816 4FC6.tmp 102 PID 1876 wrote to memory of 1472 1876 5023.tmp 103 PID 1876 wrote to memory of 1472 1876 5023.tmp 103 PID 1876 wrote to memory of 1472 1876 5023.tmp 103 PID 1472 wrote to memory of 3444 1472 5091.tmp 104 PID 1472 wrote to memory of 3444 1472 5091.tmp 104 PID 1472 wrote to memory of 3444 1472 5091.tmp 104 PID 3444 wrote to memory of 2104 3444 50EF.tmp 105 PID 3444 wrote to memory of 2104 3444 50EF.tmp 105 PID 3444 wrote to memory of 2104 3444 50EF.tmp 105 PID 2104 wrote to memory of 4820 2104 515C.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"23⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"24⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"25⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"26⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"27⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"28⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"29⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"30⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"31⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"32⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"33⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"34⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"35⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"36⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"37⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"38⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"39⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"40⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"41⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"42⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"43⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"44⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"45⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"46⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"47⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"48⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"49⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"50⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"51⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"52⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"53⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"54⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"55⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"56⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"57⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"58⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"59⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"60⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"61⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"62⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"63⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"64⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"65⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"66⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"67⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"68⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"69⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"70⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"71⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"72⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"73⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"74⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"75⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"76⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"77⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"78⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"79⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"80⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"81⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"82⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"83⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"84⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"85⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"86⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"87⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"88⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"89⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"90⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"91⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"92⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"93⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"94⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"95⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"96⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"97⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"98⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"100⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"101⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"102⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"103⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"104⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"105⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"106⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"108⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"109⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"110⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"111⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"112⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"114⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"115⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"116⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"117⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"118⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"119⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"120⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"121⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-