Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 08:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe
- Size 487KB
- Sample240603-km19msaf62
- SHA256 f0050e7efcca63d332db74c3b80232888e71e658a330e1bd3a222d68a29adccd
- MD5 398829bd2c49c601e8c0b7c3dc54ed10
- SHA1 5ea4046ca82d39acca89c9d27090c7a5799432d7
- SHA512 4c628d6f11bc6377109a216ca4e0b5a8101b99dcfa7f8165d646f92aa15875c435d38f5e6fc57e31cd37dc0cd2b0a49d4b178afd5e2a511f90e45bff2a00d63a
- SSDEEP 12288:yU5rCOTeiNQiw3X0dPQcuW5BIZ1UUGW+khXbZ:yUQOJNQiw3pW5BIZ1UU8kBb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2196 4A28.tmp 3232 4A96.tmp 2888 4B03.tmp 4752 4B9F.tmp 4088 4C1C.tmp 2308 4C99.tmp 4724 4D16.tmp 3060 4DA3.tmp 3220 4E2F.tmp 1472 4ECC.tmp 2804 4F29.tmp 2764 4F87.tmp 4544 5004.tmp 4528 5072.tmp 1592 50DF.tmp 4624 512D.tmp 4852 518B.tmp 884 51D9.tmp 3852 5227.tmp 3880 5285.tmp 2516 5302.tmp 4872 5360.tmp 3284 53BD.tmp 2136 540B.tmp 2876 5488.tmp 3456 54D7.tmp 2556 5534.tmp 5116 5592.tmp 564 55E0.tmp 916 565D.tmp 1052 56BB.tmp 4568 5719.tmp 408 5776.tmp 3740 57C5.tmp 352 5813.tmp 4476 5870.tmp 228 58BF.tmp 472 590D.tmp 3692 595B.tmp 4472 59A9.tmp 4088 59F7.tmp 4816 5A55.tmp 2408 5AA3.tmp 2308 5B01.tmp 3376 5B5E.tmp 3552 5BBC.tmp 996 5C1A.tmp 3220 5C78.tmp 2584 5CD5.tmp 4312 5D33.tmp 4576 5D91.tmp 2084 5DEF.tmp 3372 5E3D.tmp 4544 5E9B.tmp 4608 5EE9.tmp 4660 5F46.tmp 4184 5FA4.tmp 4420 6002.tmp 2188 6060.tmp 2944 60BD.tmp 4400 611B.tmp 4196 6169.tmp 4636 61B7.tmp 4264 6215.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 2196 3104 2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe 84 PID 3104 wrote to memory of 2196 3104 2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe 84 PID 3104 wrote to memory of 2196 3104 2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe 84 PID 2196 wrote to memory of 3232 2196 4A28.tmp 85 PID 2196 wrote to memory of 3232 2196 4A28.tmp 85 PID 2196 wrote to memory of 3232 2196 4A28.tmp 85 PID 3232 wrote to memory of 2888 3232 4A96.tmp 86 PID 3232 wrote to memory of 2888 3232 4A96.tmp 86 PID 3232 wrote to memory of 2888 3232 4A96.tmp 86 PID 2888 wrote to memory of 4752 2888 4B03.tmp 88 PID 2888 wrote to memory of 4752 2888 4B03.tmp 88 PID 2888 wrote to memory of 4752 2888 4B03.tmp 88 PID 4752 wrote to memory of 4088 4752 4B9F.tmp 89 PID 4752 wrote to memory of 4088 4752 4B9F.tmp 89 PID 4752 wrote to memory of 4088 4752 4B9F.tmp 89 PID 4088 wrote to memory of 2308 4088 4C1C.tmp 90 PID 4088 wrote to memory of 2308 4088 4C1C.tmp 90 PID 4088 wrote to memory of 2308 4088 4C1C.tmp 90 PID 2308 wrote to memory of 4724 2308 4C99.tmp 92 PID 2308 wrote to memory of 4724 2308 4C99.tmp 92 PID 2308 wrote to memory of 4724 2308 4C99.tmp 92 PID 4724 wrote to memory of 3060 4724 4D16.tmp 93 PID 4724 wrote to memory of 3060 4724 4D16.tmp 93 PID 4724 wrote to memory of 3060 4724 4D16.tmp 93 PID 3060 wrote to memory of 3220 3060 4DA3.tmp 94 PID 3060 wrote to memory of 3220 3060 4DA3.tmp 94 PID 3060 wrote to memory of 3220 3060 4DA3.tmp 94 PID 3220 wrote to memory of 1472 3220 4E2F.tmp 95 PID 3220 wrote to memory of 1472 3220 4E2F.tmp 95 PID 3220 wrote to memory of 1472 3220 4E2F.tmp 95 PID 1472 wrote to memory of 2804 1472 4ECC.tmp 96 PID 1472 wrote to memory of 2804 1472 4ECC.tmp 96 PID 1472 wrote to memory of 2804 1472 4ECC.tmp 96 PID 2804 wrote to memory of 2764 2804 4F29.tmp 97 PID 2804 wrote to memory of 2764 2804 4F29.tmp 97 PID 2804 wrote to memory of 2764 2804 4F29.tmp 97 PID 2764 wrote to memory of 4544 2764 4F87.tmp 98 PID 2764 wrote to memory of 4544 2764 4F87.tmp 98 PID 2764 wrote to memory of 4544 2764 4F87.tmp 98 PID 4544 wrote to memory of 4528 4544 5004.tmp 99 PID 4544 wrote to memory of 4528 4544 5004.tmp 99 PID 4544 wrote to memory of 4528 4544 5004.tmp 99 PID 4528 wrote to memory of 1592 4528 5072.tmp 100 PID 4528 wrote to memory of 1592 4528 5072.tmp 100 PID 4528 wrote to memory of 1592 4528 5072.tmp 100 PID 1592 wrote to memory of 4624 1592 50DF.tmp 101 PID 1592 wrote to memory of 4624 1592 50DF.tmp 101 PID 1592 wrote to memory of 4624 1592 50DF.tmp 101 PID 4624 wrote to memory of 4852 4624 512D.tmp 102 PID 4624 wrote to memory of 4852 4624 512D.tmp 102 PID 4624 wrote to memory of 4852 4624 512D.tmp 102 PID 4852 wrote to memory of 884 4852 518B.tmp 103 PID 4852 wrote to memory of 884 4852 518B.tmp 103 PID 4852 wrote to memory of 884 4852 518B.tmp 103 PID 884 wrote to memory of 3852 884 51D9.tmp 104 PID 884 wrote to memory of 3852 884 51D9.tmp 104 PID 884 wrote to memory of 3852 884 51D9.tmp 104 PID 3852 wrote to memory of 3880 3852 5227.tmp 105 PID 3852 wrote to memory of 3880 3852 5227.tmp 105 PID 3852 wrote to memory of 3880 3852 5227.tmp 105 PID 3880 wrote to memory of 2516 3880 5285.tmp 106 PID 3880 wrote to memory of 2516 3880 5285.tmp 106 PID 3880 wrote to memory of 2516 3880 5285.tmp 106 PID 2516 wrote to memory of 4872 2516 5302.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_398829bd2c49c601e8c0b7c3dc54ed10_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"23⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"24⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"25⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"26⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"27⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"28⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"29⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"30⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"31⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"32⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"33⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"34⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"35⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"36⤵
- Executes dropped EXE
PID:352 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"37⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"38⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"39⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"40⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"41⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"42⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"43⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"44⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"45⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"46⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"47⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"48⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"49⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"50⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"52⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"53⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"54⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"55⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"57⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"58⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"59⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"60⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"61⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"62⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"63⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"64⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"65⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"66⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"67⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"68⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"69⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"70⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"71⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"72⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"73⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"74⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"75⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"76⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"77⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"79⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"80⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"81⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"82⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"83⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"84⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"85⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"86⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"87⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"88⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"89⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"90⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"91⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"92⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"93⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"94⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"95⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"96⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"97⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"98⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"99⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"100⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"101⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"102⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"103⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"104⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"105⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"106⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"107⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"108⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"109⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"110⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"111⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"112⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"113⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"114⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"115⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"116⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"117⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"118⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"119⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"120⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"121⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-