Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe
-
Size
536KB
-
MD5
ffa88edfa1e04b72a726bf66f0bcbe1e
-
SHA1
da0b22c7bad23db8d1fff40f68716c037fc9537a
-
SHA256
3ea7722469f5e7602f42f308543ce92708bc628a469057e87b70709d87a13687
-
SHA512
057fdc64914fdb307d04f4e348183ee3a1d6f52b1348251e0ec232931509c15c8ebaa28a4b8ec93dcfbe5fa3cc15ed5116cd5f7b3d6cd166ea6da8fc9df34ab7
-
SSDEEP
12288:wU5rCOTeiUEkOux9rcOulOjSzEa5Z82/aw/IZxVJ0ZT9:wUQOJUEysOjSJXP/j/IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 48D0.tmp 4892 498C.tmp 4916 49F9.tmp 4076 4A86.tmp 1168 4B41.tmp 4088 4BBE.tmp 5084 4C1C.tmp 4080 4C8A.tmp 3976 4D07.tmp 2408 4D93.tmp 3884 4E20.tmp 3368 4EAC.tmp 3952 4F29.tmp 4116 4FB6.tmp 3592 5072.tmp 3716 50DF.tmp 3624 518B.tmp 3372 51F8.tmp 2720 5275.tmp 2540 5311.tmp 4488 538E.tmp 1484 540B.tmp 4560 5488.tmp 3100 5515.tmp 4012 55B1.tmp 2004 564E.tmp 4036 56DA.tmp 2024 5767.tmp 560 57F3.tmp 4584 5861.tmp 4884 58ED.tmp 2632 594B.tmp 4888 59D8.tmp 4792 5A26.tmp 2956 5A84.tmp 3856 5AF1.tmp 4296 5B3F.tmp 4540 5BAD.tmp 4964 5C0A.tmp 4340 5C97.tmp 660 5CF5.tmp 3124 5D43.tmp 2816 5D91.tmp 3776 5DDF.tmp 1752 5E4C.tmp 2292 5EAA.tmp 2384 5EF8.tmp 1732 5F66.tmp 1168 5FB4.tmp 3276 6002.tmp 1876 6050.tmp 4372 609E.tmp 4080 60EC.tmp 1636 614A.tmp 4708 6198.tmp 1540 61E6.tmp 3884 6234.tmp 4044 6283.tmp 4720 62E0.tmp 1688 633E.tmp 5100 639C.tmp 5056 63FA.tmp 3076 6448.tmp 1924 64A5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 1668 2144 2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe 80 PID 2144 wrote to memory of 1668 2144 2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe 80 PID 2144 wrote to memory of 1668 2144 2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe 80 PID 1668 wrote to memory of 4892 1668 48D0.tmp 81 PID 1668 wrote to memory of 4892 1668 48D0.tmp 81 PID 1668 wrote to memory of 4892 1668 48D0.tmp 81 PID 4892 wrote to memory of 4916 4892 498C.tmp 82 PID 4892 wrote to memory of 4916 4892 498C.tmp 82 PID 4892 wrote to memory of 4916 4892 498C.tmp 82 PID 4916 wrote to memory of 4076 4916 49F9.tmp 83 PID 4916 wrote to memory of 4076 4916 49F9.tmp 83 PID 4916 wrote to memory of 4076 4916 49F9.tmp 83 PID 4076 wrote to memory of 1168 4076 4A86.tmp 84 PID 4076 wrote to memory of 1168 4076 4A86.tmp 84 PID 4076 wrote to memory of 1168 4076 4A86.tmp 84 PID 1168 wrote to memory of 4088 1168 4B41.tmp 85 PID 1168 wrote to memory of 4088 1168 4B41.tmp 85 PID 1168 wrote to memory of 4088 1168 4B41.tmp 85 PID 4088 wrote to memory of 5084 4088 4BBE.tmp 86 PID 4088 wrote to memory of 5084 4088 4BBE.tmp 86 PID 4088 wrote to memory of 5084 4088 4BBE.tmp 86 PID 5084 wrote to memory of 4080 5084 4C1C.tmp 87 PID 5084 wrote to memory of 4080 5084 4C1C.tmp 87 PID 5084 wrote to memory of 4080 5084 4C1C.tmp 87 PID 4080 wrote to memory of 3976 4080 4C8A.tmp 88 PID 4080 wrote to memory of 3976 4080 4C8A.tmp 88 PID 4080 wrote to memory of 3976 4080 4C8A.tmp 88 PID 3976 wrote to memory of 2408 3976 4D07.tmp 89 PID 3976 wrote to memory of 2408 3976 4D07.tmp 89 PID 3976 wrote to memory of 2408 3976 4D07.tmp 89 PID 2408 wrote to memory of 3884 2408 4D93.tmp 90 PID 2408 wrote to memory of 3884 2408 4D93.tmp 90 PID 2408 wrote to memory of 3884 2408 4D93.tmp 90 PID 3884 wrote to memory of 3368 3884 4E20.tmp 91 PID 3884 wrote to memory of 3368 3884 4E20.tmp 91 PID 3884 wrote to memory of 3368 3884 4E20.tmp 91 PID 3368 wrote to memory of 3952 3368 4EAC.tmp 92 PID 3368 wrote to memory of 3952 3368 4EAC.tmp 92 PID 3368 wrote to memory of 3952 3368 4EAC.tmp 92 PID 3952 wrote to memory of 4116 3952 4F29.tmp 93 PID 3952 wrote to memory of 4116 3952 4F29.tmp 93 PID 3952 wrote to memory of 4116 3952 4F29.tmp 93 PID 4116 wrote to memory of 3592 4116 4FB6.tmp 94 PID 4116 wrote to memory of 3592 4116 4FB6.tmp 94 PID 4116 wrote to memory of 3592 4116 4FB6.tmp 94 PID 3592 wrote to memory of 3716 3592 5072.tmp 95 PID 3592 wrote to memory of 3716 3592 5072.tmp 95 PID 3592 wrote to memory of 3716 3592 5072.tmp 95 PID 3716 wrote to memory of 3624 3716 50DF.tmp 96 PID 3716 wrote to memory of 3624 3716 50DF.tmp 96 PID 3716 wrote to memory of 3624 3716 50DF.tmp 96 PID 3624 wrote to memory of 3372 3624 518B.tmp 97 PID 3624 wrote to memory of 3372 3624 518B.tmp 97 PID 3624 wrote to memory of 3372 3624 518B.tmp 97 PID 3372 wrote to memory of 2720 3372 51F8.tmp 98 PID 3372 wrote to memory of 2720 3372 51F8.tmp 98 PID 3372 wrote to memory of 2720 3372 51F8.tmp 98 PID 2720 wrote to memory of 2540 2720 5275.tmp 99 PID 2720 wrote to memory of 2540 2720 5275.tmp 99 PID 2720 wrote to memory of 2540 2720 5275.tmp 99 PID 2540 wrote to memory of 4488 2540 5311.tmp 100 PID 2540 wrote to memory of 4488 2540 5311.tmp 100 PID 2540 wrote to memory of 4488 2540 5311.tmp 100 PID 4488 wrote to memory of 1484 4488 538E.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_ffa88edfa1e04b72a726bf66f0bcbe1e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"23⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"24⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"25⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"26⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"27⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"28⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"29⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"30⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"31⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"32⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"33⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"34⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"35⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"36⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"37⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"38⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"39⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"40⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"41⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"42⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"43⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"44⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"45⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"46⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"47⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"48⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"49⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"50⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"51⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"52⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"53⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"54⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"55⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"56⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"57⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"58⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"59⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"60⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"61⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"62⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"63⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"64⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"65⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"66⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"67⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"68⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"69⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"70⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"71⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"72⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"73⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"74⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"75⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"76⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"77⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"78⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"79⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"80⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"81⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"82⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"83⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"84⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"85⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"86⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"87⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"88⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"89⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"91⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"92⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"93⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"94⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"95⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"96⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"97⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"98⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"99⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"100⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"101⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"102⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"103⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"104⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"105⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"106⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"107⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"108⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"109⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"110⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"111⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"112⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"113⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"114⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"115⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"116⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"117⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"118⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"119⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"120⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"121⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-