Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 16:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe
-
Size
765KB
-
MD5
d3da168a9b137e9c54a1a56c5294ac92
-
SHA1
98247dd3b6e562d02702e0971d42143ac370a544
-
SHA256
796714ca2240641b8e4d5ff13fe55931f14e32b3134b3afa5b3ee7a956dba939
-
SHA512
c0e628cfe9a192affeaef9b788dadd426201ff5bfca3e0a2fc0fa4bae907ec5ef4e047647c0850779fa7a2823277892bc1d1ccad197fbd5001600467fce0646d
-
SSDEEP
12288:ZU5rCOTeiDKN4t80JgBqEoY9gIyNuv3ZF5rn5rLOa54U5w5A:ZUQOJDWVmg4EoYWU3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4212 4297.tmp 1524 4343.tmp 4380 43C0.tmp 312 442D.tmp 3736 44AA.tmp 2528 4527.tmp 3116 45A4.tmp 5112 4631.tmp 2316 468E.tmp 1968 46FC.tmp 4768 4779.tmp 3464 4805.tmp 2828 4882.tmp 1484 48FF.tmp 1824 498C.tmp 3780 4A09.tmp 2284 4A67.tmp 5072 4AC4.tmp 3856 4B32.tmp 532 4BAF.tmp 1644 4C4B.tmp 3768 4CB8.tmp 1480 4D35.tmp 524 4DA3.tmp 2808 4E10.tmp 4600 4E7E.tmp 2956 4EFB.tmp 2016 4F78.tmp 4524 4FF5.tmp 4604 5072.tmp 2404 50CF.tmp 4184 515C.tmp 1352 51F8.tmp 2692 5256.tmp 2248 52A4.tmp 1952 52F2.tmp 1264 5340.tmp 1420 538E.tmp 4724 53EC.tmp 1600 544A.tmp 4692 54A8.tmp 2244 5505.tmp 2380 5554.tmp 1492 55A2.tmp 4616 55F0.tmp 4856 564E.tmp 1768 569C.tmp 2480 56EA.tmp 4796 5738.tmp 4312 5786.tmp 4484 57D4.tmp 216 5832.tmp 2992 5880.tmp 3104 58CE.tmp 4456 591C.tmp 4536 596A.tmp 520 59C8.tmp 1908 5A16.tmp 5028 5A74.tmp 1776 5AD2.tmp 3300 5B30.tmp 556 5B8D.tmp 2740 5BEB.tmp 2308 5C49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 4212 348 2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe 83 PID 348 wrote to memory of 4212 348 2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe 83 PID 348 wrote to memory of 4212 348 2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe 83 PID 4212 wrote to memory of 1524 4212 4297.tmp 84 PID 4212 wrote to memory of 1524 4212 4297.tmp 84 PID 4212 wrote to memory of 1524 4212 4297.tmp 84 PID 1524 wrote to memory of 4380 1524 4343.tmp 85 PID 1524 wrote to memory of 4380 1524 4343.tmp 85 PID 1524 wrote to memory of 4380 1524 4343.tmp 85 PID 4380 wrote to memory of 312 4380 43C0.tmp 87 PID 4380 wrote to memory of 312 4380 43C0.tmp 87 PID 4380 wrote to memory of 312 4380 43C0.tmp 87 PID 312 wrote to memory of 3736 312 442D.tmp 89 PID 312 wrote to memory of 3736 312 442D.tmp 89 PID 312 wrote to memory of 3736 312 442D.tmp 89 PID 3736 wrote to memory of 2528 3736 44AA.tmp 90 PID 3736 wrote to memory of 2528 3736 44AA.tmp 90 PID 3736 wrote to memory of 2528 3736 44AA.tmp 90 PID 2528 wrote to memory of 3116 2528 4527.tmp 92 PID 2528 wrote to memory of 3116 2528 4527.tmp 92 PID 2528 wrote to memory of 3116 2528 4527.tmp 92 PID 3116 wrote to memory of 5112 3116 45A4.tmp 93 PID 3116 wrote to memory of 5112 3116 45A4.tmp 93 PID 3116 wrote to memory of 5112 3116 45A4.tmp 93 PID 5112 wrote to memory of 2316 5112 4631.tmp 94 PID 5112 wrote to memory of 2316 5112 4631.tmp 94 PID 5112 wrote to memory of 2316 5112 4631.tmp 94 PID 2316 wrote to memory of 1968 2316 468E.tmp 95 PID 2316 wrote to memory of 1968 2316 468E.tmp 95 PID 2316 wrote to memory of 1968 2316 468E.tmp 95 PID 1968 wrote to memory of 4768 1968 46FC.tmp 96 PID 1968 wrote to memory of 4768 1968 46FC.tmp 96 PID 1968 wrote to memory of 4768 1968 46FC.tmp 96 PID 4768 wrote to memory of 3464 4768 4779.tmp 97 PID 4768 wrote to memory of 3464 4768 4779.tmp 97 PID 4768 wrote to memory of 3464 4768 4779.tmp 97 PID 3464 wrote to memory of 2828 3464 4805.tmp 98 PID 3464 wrote to memory of 2828 3464 4805.tmp 98 PID 3464 wrote to memory of 2828 3464 4805.tmp 98 PID 2828 wrote to memory of 1484 2828 4882.tmp 99 PID 2828 wrote to memory of 1484 2828 4882.tmp 99 PID 2828 wrote to memory of 1484 2828 4882.tmp 99 PID 1484 wrote to memory of 1824 1484 48FF.tmp 100 PID 1484 wrote to memory of 1824 1484 48FF.tmp 100 PID 1484 wrote to memory of 1824 1484 48FF.tmp 100 PID 1824 wrote to memory of 3780 1824 498C.tmp 101 PID 1824 wrote to memory of 3780 1824 498C.tmp 101 PID 1824 wrote to memory of 3780 1824 498C.tmp 101 PID 3780 wrote to memory of 2284 3780 4A09.tmp 102 PID 3780 wrote to memory of 2284 3780 4A09.tmp 102 PID 3780 wrote to memory of 2284 3780 4A09.tmp 102 PID 2284 wrote to memory of 5072 2284 4A67.tmp 103 PID 2284 wrote to memory of 5072 2284 4A67.tmp 103 PID 2284 wrote to memory of 5072 2284 4A67.tmp 103 PID 5072 wrote to memory of 3856 5072 4AC4.tmp 104 PID 5072 wrote to memory of 3856 5072 4AC4.tmp 104 PID 5072 wrote to memory of 3856 5072 4AC4.tmp 104 PID 3856 wrote to memory of 532 3856 4B32.tmp 105 PID 3856 wrote to memory of 532 3856 4B32.tmp 105 PID 3856 wrote to memory of 532 3856 4B32.tmp 105 PID 532 wrote to memory of 1644 532 4BAF.tmp 106 PID 532 wrote to memory of 1644 532 4BAF.tmp 106 PID 532 wrote to memory of 1644 532 4BAF.tmp 106 PID 1644 wrote to memory of 3768 1644 4C4B.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_d3da168a9b137e9c54a1a56c5294ac92_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"23⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"24⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"25⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"26⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"27⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"28⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"29⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"30⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"31⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"32⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"33⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"34⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"35⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"36⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"37⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"38⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"39⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"40⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"41⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"42⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"43⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"44⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"45⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"46⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"47⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"48⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"49⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"50⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"52⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"53⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"54⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"55⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"56⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"57⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"58⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"59⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"60⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"61⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"62⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"63⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"64⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"65⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"66⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"67⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"68⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"69⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"70⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"71⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"72⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"73⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"74⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"75⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"76⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"77⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"78⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"79⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"80⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"81⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"82⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"83⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"84⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"85⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"86⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"87⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"88⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"89⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"90⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"91⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"92⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"93⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"94⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"95⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"96⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"97⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"98⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"99⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"100⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"101⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"102⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"103⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"104⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"105⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"106⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"107⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"108⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"109⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"110⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"111⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"112⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"113⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"114⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"115⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"116⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"117⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"118⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"119⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"120⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"121⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"122⤵PID:520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-