Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe
-
Size
529KB
-
MD5
fa64a4d01b3106981d92c64035d7f8bd
-
SHA1
8574cffc094584ee7b405825298f6431872870d9
-
SHA256
fa67fb33ef551a9078a7b250bd5efafb26ba1fa154c87460f6a3c9297029511e
-
SHA512
7e227bc77ce0a45902fe53c7d9b48015d6c74ef9dd99711e3702448adad9b922c53fae61410ef8efd296d1ea4516729ffa1fde4cafc998670954943b52e5a43d
-
SSDEEP
12288:NU5rCOTeij9YotIZB2Ln4fPL058UQ7BuLw0TZwlH4Hp:NUQOJj9BtIZBnfPL02UuELTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3476 4B41.tmp 1148 4BDE.tmp 3336 4C3B.tmp 4784 4CB8.tmp 3124 4D45.tmp 4952 4DB2.tmp 2936 4E20.tmp 1292 4E8D.tmp 2548 4EEB.tmp 4944 4F49.tmp 2748 4F97.tmp 2960 4FE5.tmp 4020 5033.tmp 2560 50A0.tmp 5108 510E.tmp 1424 516C.tmp 1328 51D9.tmp 1988 5246.tmp 1576 52A4.tmp 1732 5311.tmp 2624 538E.tmp 1980 53EC.tmp 3164 544A.tmp 1508 54C7.tmp 2736 5544.tmp 2152 55A2.tmp 3888 561F.tmp 2492 569C.tmp 3740 56EA.tmp 512 5757.tmp 4012 57C5.tmp 180 5832.tmp 4580 5880.tmp 440 58DE.tmp 4612 592C.tmp 2304 597A.tmp 116 59D8.tmp 1144 5A36.tmp 2340 5A84.tmp 4280 5AD2.tmp 3936 5B20.tmp 3680 5B6E.tmp 4040 5BCC.tmp 1220 5C2A.tmp 3436 5C87.tmp 3516 5CD5.tmp 4928 5D24.tmp 2176 5D81.tmp 5084 5DDF.tmp 2740 5E2D.tmp 3372 5E8B.tmp 3492 5ED9.tmp 3876 5F27.tmp 2728 5F75.tmp 1440 5FC3.tmp 3684 6012.tmp 3884 606F.tmp 4416 60BD.tmp 2236 611B.tmp 4968 6169.tmp 4316 61B7.tmp 3108 6215.tmp 208 6273.tmp 3484 62C1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3476 4816 2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe 80 PID 4816 wrote to memory of 3476 4816 2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe 80 PID 4816 wrote to memory of 3476 4816 2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe 80 PID 3476 wrote to memory of 1148 3476 4B41.tmp 81 PID 3476 wrote to memory of 1148 3476 4B41.tmp 81 PID 3476 wrote to memory of 1148 3476 4B41.tmp 81 PID 1148 wrote to memory of 3336 1148 4BDE.tmp 82 PID 1148 wrote to memory of 3336 1148 4BDE.tmp 82 PID 1148 wrote to memory of 3336 1148 4BDE.tmp 82 PID 3336 wrote to memory of 4784 3336 4C3B.tmp 83 PID 3336 wrote to memory of 4784 3336 4C3B.tmp 83 PID 3336 wrote to memory of 4784 3336 4C3B.tmp 83 PID 4784 wrote to memory of 3124 4784 4CB8.tmp 84 PID 4784 wrote to memory of 3124 4784 4CB8.tmp 84 PID 4784 wrote to memory of 3124 4784 4CB8.tmp 84 PID 3124 wrote to memory of 4952 3124 4D45.tmp 85 PID 3124 wrote to memory of 4952 3124 4D45.tmp 85 PID 3124 wrote to memory of 4952 3124 4D45.tmp 85 PID 4952 wrote to memory of 2936 4952 4DB2.tmp 86 PID 4952 wrote to memory of 2936 4952 4DB2.tmp 86 PID 4952 wrote to memory of 2936 4952 4DB2.tmp 86 PID 2936 wrote to memory of 1292 2936 4E20.tmp 87 PID 2936 wrote to memory of 1292 2936 4E20.tmp 87 PID 2936 wrote to memory of 1292 2936 4E20.tmp 87 PID 1292 wrote to memory of 2548 1292 4E8D.tmp 88 PID 1292 wrote to memory of 2548 1292 4E8D.tmp 88 PID 1292 wrote to memory of 2548 1292 4E8D.tmp 88 PID 2548 wrote to memory of 4944 2548 4EEB.tmp 89 PID 2548 wrote to memory of 4944 2548 4EEB.tmp 89 PID 2548 wrote to memory of 4944 2548 4EEB.tmp 89 PID 4944 wrote to memory of 2748 4944 4F49.tmp 90 PID 4944 wrote to memory of 2748 4944 4F49.tmp 90 PID 4944 wrote to memory of 2748 4944 4F49.tmp 90 PID 2748 wrote to memory of 2960 2748 4F97.tmp 91 PID 2748 wrote to memory of 2960 2748 4F97.tmp 91 PID 2748 wrote to memory of 2960 2748 4F97.tmp 91 PID 2960 wrote to memory of 4020 2960 4FE5.tmp 92 PID 2960 wrote to memory of 4020 2960 4FE5.tmp 92 PID 2960 wrote to memory of 4020 2960 4FE5.tmp 92 PID 4020 wrote to memory of 2560 4020 5033.tmp 93 PID 4020 wrote to memory of 2560 4020 5033.tmp 93 PID 4020 wrote to memory of 2560 4020 5033.tmp 93 PID 2560 wrote to memory of 5108 2560 50A0.tmp 94 PID 2560 wrote to memory of 5108 2560 50A0.tmp 94 PID 2560 wrote to memory of 5108 2560 50A0.tmp 94 PID 5108 wrote to memory of 1424 5108 510E.tmp 95 PID 5108 wrote to memory of 1424 5108 510E.tmp 95 PID 5108 wrote to memory of 1424 5108 510E.tmp 95 PID 1424 wrote to memory of 1328 1424 516C.tmp 96 PID 1424 wrote to memory of 1328 1424 516C.tmp 96 PID 1424 wrote to memory of 1328 1424 516C.tmp 96 PID 1328 wrote to memory of 1988 1328 51D9.tmp 97 PID 1328 wrote to memory of 1988 1328 51D9.tmp 97 PID 1328 wrote to memory of 1988 1328 51D9.tmp 97 PID 1988 wrote to memory of 1576 1988 5246.tmp 98 PID 1988 wrote to memory of 1576 1988 5246.tmp 98 PID 1988 wrote to memory of 1576 1988 5246.tmp 98 PID 1576 wrote to memory of 1732 1576 52A4.tmp 99 PID 1576 wrote to memory of 1732 1576 52A4.tmp 99 PID 1576 wrote to memory of 1732 1576 52A4.tmp 99 PID 1732 wrote to memory of 2624 1732 5311.tmp 100 PID 1732 wrote to memory of 2624 1732 5311.tmp 100 PID 1732 wrote to memory of 2624 1732 5311.tmp 100 PID 2624 wrote to memory of 1980 2624 538E.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_fa64a4d01b3106981d92c64035d7f8bd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"23⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"24⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"25⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"26⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"27⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"28⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"29⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"30⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"31⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"32⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"33⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"34⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"35⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"36⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"37⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"38⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"39⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"40⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"41⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"42⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"43⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"44⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"45⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"46⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"47⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"48⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"49⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"50⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"51⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"52⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"53⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"54⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"55⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"56⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"57⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"58⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"59⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"60⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"61⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"62⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"63⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"64⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"65⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"66⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"67⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"68⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"69⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"71⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"72⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"73⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"74⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"75⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"76⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"77⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"78⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"79⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"80⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"81⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"82⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"83⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"84⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"85⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"86⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"87⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"88⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"89⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"90⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"91⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"92⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"93⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"95⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"96⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"97⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"98⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"99⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"100⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"101⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"102⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"104⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"105⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"106⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"108⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"109⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"110⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"111⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"112⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"113⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"114⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"115⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"116⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"117⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"118⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"119⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"120⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"121⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"122⤵PID:1060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-