Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe
-
Size
529KB
-
MD5
76947319ebd19c139fcadee3580ffe9c
-
SHA1
fcc316ec1f8ffaf53604e4bc2e3d7f96aef0988f
-
SHA256
e51f4d5d7ae88b104c413009c9c60b2a77097e29aa2198086bcca88ee0d236d6
-
SHA512
b2bf519959463e036d5642a2f9c64c56d3718fc3a32e7563b1955c300f46e9d5ffbf60c28adf764cf64eb28de06363136a77a4e1bcc86c8fcb41fd8a003e1276
-
SSDEEP
12288:NU5rCOTeijvcfcr/2zbdoG9Of8nvmkTZwlH4Hp:NUQOJjFrezRoG9/nvmkTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3868 45A4.tmp 1164 4640.tmp 2856 46BD.tmp 4080 470B.tmp 3688 4769.tmp 4332 47E6.tmp 3408 4863.tmp 4364 48C1.tmp 3624 491F.tmp 4264 497C.tmp 2052 49EA.tmp 4980 4A47.tmp 708 4AC4.tmp 2008 4B32.tmp 1364 4BAF.tmp 456 4BFD.tmp 2332 4C5B.tmp 4112 4CC8.tmp 2240 4D16.tmp 1548 4D74.tmp 4736 4DE1.tmp 4476 4E2F.tmp 1604 4E9D.tmp 808 4EEB.tmp 1232 4F49.tmp 5024 4F97.tmp 4600 4FF5.tmp 4424 5062.tmp 4836 50C0.tmp 2544 510E.tmp 4084 517B.tmp 4316 51E9.tmp 2908 5246.tmp 472 5294.tmp 1552 52E3.tmp 2644 5331.tmp 3896 538E.tmp 544 53DD.tmp 4248 542B.tmp 3136 5469.tmp 2604 54B7.tmp 3700 5515.tmp 5008 5573.tmp 3216 55C1.tmp 1012 560F.tmp 2168 565D.tmp 3676 56AB.tmp 2788 56F9.tmp 4072 5748.tmp 3084 57B5.tmp 3576 5803.tmp 4392 5861.tmp 1128 58BF.tmp 1544 590D.tmp 2096 596A.tmp 4160 59C8.tmp 4076 5A26.tmp 3584 5A84.tmp 2856 5AE1.tmp 2968 5B30.tmp 1736 5B7E.tmp 656 5BDB.tmp 4276 5C39.tmp 344 5C97.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 3868 2284 2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe 83 PID 2284 wrote to memory of 3868 2284 2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe 83 PID 2284 wrote to memory of 3868 2284 2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe 83 PID 3868 wrote to memory of 1164 3868 45A4.tmp 84 PID 3868 wrote to memory of 1164 3868 45A4.tmp 84 PID 3868 wrote to memory of 1164 3868 45A4.tmp 84 PID 1164 wrote to memory of 2856 1164 4640.tmp 85 PID 1164 wrote to memory of 2856 1164 4640.tmp 85 PID 1164 wrote to memory of 2856 1164 4640.tmp 85 PID 2856 wrote to memory of 4080 2856 46BD.tmp 86 PID 2856 wrote to memory of 4080 2856 46BD.tmp 86 PID 2856 wrote to memory of 4080 2856 46BD.tmp 86 PID 4080 wrote to memory of 3688 4080 470B.tmp 87 PID 4080 wrote to memory of 3688 4080 470B.tmp 87 PID 4080 wrote to memory of 3688 4080 470B.tmp 87 PID 3688 wrote to memory of 4332 3688 4769.tmp 88 PID 3688 wrote to memory of 4332 3688 4769.tmp 88 PID 3688 wrote to memory of 4332 3688 4769.tmp 88 PID 4332 wrote to memory of 3408 4332 47E6.tmp 89 PID 4332 wrote to memory of 3408 4332 47E6.tmp 89 PID 4332 wrote to memory of 3408 4332 47E6.tmp 89 PID 3408 wrote to memory of 4364 3408 4863.tmp 90 PID 3408 wrote to memory of 4364 3408 4863.tmp 90 PID 3408 wrote to memory of 4364 3408 4863.tmp 90 PID 4364 wrote to memory of 3624 4364 48C1.tmp 91 PID 4364 wrote to memory of 3624 4364 48C1.tmp 91 PID 4364 wrote to memory of 3624 4364 48C1.tmp 91 PID 3624 wrote to memory of 4264 3624 491F.tmp 92 PID 3624 wrote to memory of 4264 3624 491F.tmp 92 PID 3624 wrote to memory of 4264 3624 491F.tmp 92 PID 4264 wrote to memory of 2052 4264 497C.tmp 93 PID 4264 wrote to memory of 2052 4264 497C.tmp 93 PID 4264 wrote to memory of 2052 4264 497C.tmp 93 PID 2052 wrote to memory of 4980 2052 49EA.tmp 94 PID 2052 wrote to memory of 4980 2052 49EA.tmp 94 PID 2052 wrote to memory of 4980 2052 49EA.tmp 94 PID 4980 wrote to memory of 708 4980 4A47.tmp 95 PID 4980 wrote to memory of 708 4980 4A47.tmp 95 PID 4980 wrote to memory of 708 4980 4A47.tmp 95 PID 708 wrote to memory of 2008 708 4AC4.tmp 96 PID 708 wrote to memory of 2008 708 4AC4.tmp 96 PID 708 wrote to memory of 2008 708 4AC4.tmp 96 PID 2008 wrote to memory of 1364 2008 4B32.tmp 97 PID 2008 wrote to memory of 1364 2008 4B32.tmp 97 PID 2008 wrote to memory of 1364 2008 4B32.tmp 97 PID 1364 wrote to memory of 456 1364 4BAF.tmp 98 PID 1364 wrote to memory of 456 1364 4BAF.tmp 98 PID 1364 wrote to memory of 456 1364 4BAF.tmp 98 PID 456 wrote to memory of 2332 456 4BFD.tmp 99 PID 456 wrote to memory of 2332 456 4BFD.tmp 99 PID 456 wrote to memory of 2332 456 4BFD.tmp 99 PID 2332 wrote to memory of 4112 2332 4C5B.tmp 100 PID 2332 wrote to memory of 4112 2332 4C5B.tmp 100 PID 2332 wrote to memory of 4112 2332 4C5B.tmp 100 PID 4112 wrote to memory of 2240 4112 4CC8.tmp 101 PID 4112 wrote to memory of 2240 4112 4CC8.tmp 101 PID 4112 wrote to memory of 2240 4112 4CC8.tmp 101 PID 2240 wrote to memory of 1548 2240 4D16.tmp 102 PID 2240 wrote to memory of 1548 2240 4D16.tmp 102 PID 2240 wrote to memory of 1548 2240 4D16.tmp 102 PID 1548 wrote to memory of 4736 1548 4D74.tmp 103 PID 1548 wrote to memory of 4736 1548 4D74.tmp 103 PID 1548 wrote to memory of 4736 1548 4D74.tmp 103 PID 4736 wrote to memory of 4476 4736 4DE1.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_76947319ebd19c139fcadee3580ffe9c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"23⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"24⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"25⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"26⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"27⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"28⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"29⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"30⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"31⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"32⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"33⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"34⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"35⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"36⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"37⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"38⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"39⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"40⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"41⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"42⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"43⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"44⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"45⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"46⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"47⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"48⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"49⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"50⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"51⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"52⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"53⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"54⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"55⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"56⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"57⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"58⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"59⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"60⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"61⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"62⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"63⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"64⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"65⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"66⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"67⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"68⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"69⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"70⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"71⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"72⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"73⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"74⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"75⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"76⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"77⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"78⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"79⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"80⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"81⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"82⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"83⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"84⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"85⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"86⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"87⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"88⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"89⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"90⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"91⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"92⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"94⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"96⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"97⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"99⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"100⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"101⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"102⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"103⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"104⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"105⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"106⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"107⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"108⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"109⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"110⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"111⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"112⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"113⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"114⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"115⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"116⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"117⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"118⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"119⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"120⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"121⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-