Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
-
Size
488KB
-
MD5
8aaee44445876f855a35c09b67b55101
-
SHA1
5ef36cb006821c6134f13c5e7849bf329ce371ca
-
SHA256
b0792f65b8490484206ce11b4b3d7e5d5b577e468c7b22186b6f5ced09d376f1
-
SHA512
6077b0dd083f400bed749d34a26aae14bb34474adb173e8f3dc5448255f4ca21fe56907b028e732aa6bebce5ab5a02fd0f9680e8494aec83dd51a3cfc7a6ee1b
-
SSDEEP
12288:/U5rCOTeiD6+p3/zCVgMfoULiUYxVTlNZ:/UQOJDJPAgMoUY5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4844 442D.tmp 4764 44AA.tmp 3184 4508.tmp 1956 4594.tmp 4076 45F2.tmp 968 465F.tmp 2552 46CD.tmp 2172 472B.tmp 1688 4798.tmp 2096 47E6.tmp 376 4844.tmp 508 48A2.tmp 4220 48F0.tmp 3180 496D.tmp 2216 49CA.tmp 3744 4A28.tmp 4004 4A86.tmp 4804 4AE4.tmp 3704 4B51.tmp 1044 4BBE.tmp 3076 4C3B.tmp 4652 4C8A.tmp 3248 4CF7.tmp 2092 4D45.tmp 1948 4D93.tmp 2896 4DE1.tmp 2476 4E5E.tmp 388 4ECC.tmp 936 4F29.tmp 2460 4F87.tmp 856 4FE5.tmp 3260 5043.tmp 2616 50C0.tmp 1216 511D.tmp 3720 517B.tmp 2980 51D9.tmp 3332 5227.tmp 4940 5285.tmp 4636 52E3.tmp 2176 5340.tmp 3660 539E.tmp 4888 53EC.tmp 1428 544A.tmp 2824 5498.tmp 3940 5505.tmp 5020 5554.tmp 4452 55B1.tmp 1020 55FF.tmp 1784 564E.tmp 3008 569C.tmp 4348 56EA.tmp 5104 5738.tmp 1396 5796.tmp 1120 57E4.tmp 224 5842.tmp 1336 589F.tmp 1580 58FD.tmp 1648 594B.tmp 4484 5999.tmp 4268 59E7.tmp 4828 5A45.tmp 1008 5A93.tmp 5048 5AE1.tmp 3200 5B30.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4844 4776 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 85 PID 4776 wrote to memory of 4844 4776 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 85 PID 4776 wrote to memory of 4844 4776 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 85 PID 4844 wrote to memory of 4764 4844 442D.tmp 86 PID 4844 wrote to memory of 4764 4844 442D.tmp 86 PID 4844 wrote to memory of 4764 4844 442D.tmp 86 PID 4764 wrote to memory of 3184 4764 44AA.tmp 87 PID 4764 wrote to memory of 3184 4764 44AA.tmp 87 PID 4764 wrote to memory of 3184 4764 44AA.tmp 87 PID 3184 wrote to memory of 1956 3184 4508.tmp 88 PID 3184 wrote to memory of 1956 3184 4508.tmp 88 PID 3184 wrote to memory of 1956 3184 4508.tmp 88 PID 1956 wrote to memory of 4076 1956 4594.tmp 89 PID 1956 wrote to memory of 4076 1956 4594.tmp 89 PID 1956 wrote to memory of 4076 1956 4594.tmp 89 PID 4076 wrote to memory of 968 4076 45F2.tmp 90 PID 4076 wrote to memory of 968 4076 45F2.tmp 90 PID 4076 wrote to memory of 968 4076 45F2.tmp 90 PID 968 wrote to memory of 2552 968 465F.tmp 91 PID 968 wrote to memory of 2552 968 465F.tmp 91 PID 968 wrote to memory of 2552 968 465F.tmp 91 PID 2552 wrote to memory of 2172 2552 46CD.tmp 92 PID 2552 wrote to memory of 2172 2552 46CD.tmp 92 PID 2552 wrote to memory of 2172 2552 46CD.tmp 92 PID 2172 wrote to memory of 1688 2172 472B.tmp 93 PID 2172 wrote to memory of 1688 2172 472B.tmp 93 PID 2172 wrote to memory of 1688 2172 472B.tmp 93 PID 1688 wrote to memory of 2096 1688 4798.tmp 94 PID 1688 wrote to memory of 2096 1688 4798.tmp 94 PID 1688 wrote to memory of 2096 1688 4798.tmp 94 PID 2096 wrote to memory of 376 2096 47E6.tmp 95 PID 2096 wrote to memory of 376 2096 47E6.tmp 95 PID 2096 wrote to memory of 376 2096 47E6.tmp 95 PID 376 wrote to memory of 508 376 4844.tmp 96 PID 376 wrote to memory of 508 376 4844.tmp 96 PID 376 wrote to memory of 508 376 4844.tmp 96 PID 508 wrote to memory of 4220 508 48A2.tmp 97 PID 508 wrote to memory of 4220 508 48A2.tmp 97 PID 508 wrote to memory of 4220 508 48A2.tmp 97 PID 4220 wrote to memory of 3180 4220 48F0.tmp 98 PID 4220 wrote to memory of 3180 4220 48F0.tmp 98 PID 4220 wrote to memory of 3180 4220 48F0.tmp 98 PID 3180 wrote to memory of 2216 3180 496D.tmp 99 PID 3180 wrote to memory of 2216 3180 496D.tmp 99 PID 3180 wrote to memory of 2216 3180 496D.tmp 99 PID 2216 wrote to memory of 3744 2216 49CA.tmp 100 PID 2216 wrote to memory of 3744 2216 49CA.tmp 100 PID 2216 wrote to memory of 3744 2216 49CA.tmp 100 PID 3744 wrote to memory of 4004 3744 4A28.tmp 101 PID 3744 wrote to memory of 4004 3744 4A28.tmp 101 PID 3744 wrote to memory of 4004 3744 4A28.tmp 101 PID 4004 wrote to memory of 4804 4004 4A86.tmp 104 PID 4004 wrote to memory of 4804 4004 4A86.tmp 104 PID 4004 wrote to memory of 4804 4004 4A86.tmp 104 PID 4804 wrote to memory of 3704 4804 4AE4.tmp 105 PID 4804 wrote to memory of 3704 4804 4AE4.tmp 105 PID 4804 wrote to memory of 3704 4804 4AE4.tmp 105 PID 3704 wrote to memory of 1044 3704 4B51.tmp 106 PID 3704 wrote to memory of 1044 3704 4B51.tmp 106 PID 3704 wrote to memory of 1044 3704 4B51.tmp 106 PID 1044 wrote to memory of 3076 1044 4BBE.tmp 107 PID 1044 wrote to memory of 3076 1044 4BBE.tmp 107 PID 1044 wrote to memory of 3076 1044 4BBE.tmp 107 PID 3076 wrote to memory of 4652 3076 4C3B.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"23⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"24⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"25⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"26⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"27⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"28⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"29⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"30⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"31⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"32⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"33⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"34⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"35⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"36⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"37⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"38⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"39⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"40⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"41⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"42⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"43⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"44⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"45⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"46⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"47⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"48⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"49⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"50⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"51⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"52⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"53⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"54⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"55⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"56⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"57⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"58⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"59⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"60⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"61⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"62⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"63⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"64⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"65⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"66⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"67⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"68⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"69⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"70⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"72⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"73⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"74⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"75⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"76⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"78⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"80⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"81⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"82⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"83⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"84⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"85⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"86⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"87⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"88⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"89⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"90⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"91⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"92⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"93⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"94⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"95⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"96⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"97⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"98⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"99⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"100⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"101⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"102⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"103⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"104⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"105⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"106⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"107⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"108⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"109⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"110⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"111⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"112⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"113⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"114⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"115⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"116⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"117⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"118⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"119⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"120⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"121⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-