Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe
-
Size
712KB
-
MD5
cba87e5c53c0148bd5929a8c214b36ef
-
SHA1
e228c92e911cb09b9bd9fb3f53cde338b664e7ca
-
SHA256
2cf4f72dcac2a28acaa7b9473623b1200de6b2fa5485d1c12cc0b27258834d18
-
SHA512
5a265bcc8dd1d117042f46ed391ab86e82d4b5ed0b7563453dbc860a7b0a386536721c18e4516c23173d86f9ea2341a1d47418335af1fe49dcf84b7f547bed26
-
SSDEEP
12288:FU5rCOTeiDaUcCsyQdPArsGD/xYSAcchS7PNZdCvq5TJLCvY90D8/LVBlVk736YI:FUQOJDaUcCsyQdPNGD/x0cc0PNnCvq55
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
4575.tmp4621.tmp46AE.tmp4779.tmp4825.tmp4892.tmp490F.tmp497C.tmp49EA.tmp4A67.tmp4AE4.tmp4B70.tmp4BDE.tmp4C5B.tmp4CB8.tmp4D55.tmp4E01.tmp4E8D.tmp4F39.tmp4FC6.tmp5062.tmp50FE.tmp51C9.tmp5246.tmp52A4.tmp5321.tmp53AE.tmp542B.tmp54C7.tmp5554.tmp55D1.tmp562E.tmp56DA.tmp5728.tmp5786.tmp57E4.tmp5842.tmp58AF.tmp590D.tmp596A.tmp59B9.tmp5A16.tmp5A74.tmp5AD2.tmp5B30.tmp5B8D.tmp5BEB.tmp5C49.tmp5C97.tmp5CF5.tmp5D43.tmp5DB0.tmp5E0E.tmp5E6C.tmp5EC9.tmp5F27.tmp5F75.tmp5FE3.tmp6040.tmp609E.tmp60FC.tmp615A.tmp61B7.tmp6206.tmppid process 1912 4575.tmp 5100 4621.tmp 3408 46AE.tmp 1096 4779.tmp 4164 4825.tmp 2784 4892.tmp 2684 490F.tmp 716 497C.tmp 2404 49EA.tmp 4760 4A67.tmp 4848 4AE4.tmp 3224 4B70.tmp 540 4BDE.tmp 4364 4C5B.tmp 1420 4CB8.tmp 4056 4D55.tmp 4520 4E01.tmp 2964 4E8D.tmp 4528 4F39.tmp 4512 4FC6.tmp 4536 5062.tmp 4704 50FE.tmp 3424 51C9.tmp 1600 5246.tmp 4012 52A4.tmp 2576 5321.tmp 2056 53AE.tmp 3300 542B.tmp 2516 54C7.tmp 4548 5554.tmp 2380 55D1.tmp 4204 562E.tmp 996 56DA.tmp 2412 5728.tmp 3516 5786.tmp 3256 57E4.tmp 8 5842.tmp 676 58AF.tmp 1988 590D.tmp 4820 596A.tmp 2264 59B9.tmp 1396 5A16.tmp 4368 5A74.tmp 2252 5AD2.tmp 4304 5B30.tmp 1892 5B8D.tmp 5100 5BEB.tmp 3408 5C49.tmp 1096 5C97.tmp 1492 5CF5.tmp 852 5D43.tmp 384 5DB0.tmp 1332 5E0E.tmp 2568 5E6C.tmp 2992 5EC9.tmp 3076 5F27.tmp 2520 5F75.tmp 1028 5FE3.tmp 4552 6040.tmp 3324 609E.tmp 3100 60FC.tmp 2676 615A.tmp 4520 61B7.tmp 756 6206.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe4575.tmp4621.tmp46AE.tmp4779.tmp4825.tmp4892.tmp490F.tmp497C.tmp49EA.tmp4A67.tmp4AE4.tmp4B70.tmp4BDE.tmp4C5B.tmp4CB8.tmp4D55.tmp4E01.tmp4E8D.tmp4F39.tmp4FC6.tmp5062.tmpdescription pid process target process PID 1612 wrote to memory of 1912 1612 2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe 4575.tmp PID 1612 wrote to memory of 1912 1612 2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe 4575.tmp PID 1612 wrote to memory of 1912 1612 2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe 4575.tmp PID 1912 wrote to memory of 5100 1912 4575.tmp 4621.tmp PID 1912 wrote to memory of 5100 1912 4575.tmp 4621.tmp PID 1912 wrote to memory of 5100 1912 4575.tmp 4621.tmp PID 5100 wrote to memory of 3408 5100 4621.tmp 46AE.tmp PID 5100 wrote to memory of 3408 5100 4621.tmp 46AE.tmp PID 5100 wrote to memory of 3408 5100 4621.tmp 46AE.tmp PID 3408 wrote to memory of 1096 3408 46AE.tmp 4779.tmp PID 3408 wrote to memory of 1096 3408 46AE.tmp 4779.tmp PID 3408 wrote to memory of 1096 3408 46AE.tmp 4779.tmp PID 1096 wrote to memory of 4164 1096 4779.tmp 4825.tmp PID 1096 wrote to memory of 4164 1096 4779.tmp 4825.tmp PID 1096 wrote to memory of 4164 1096 4779.tmp 4825.tmp PID 4164 wrote to memory of 2784 4164 4825.tmp 4892.tmp PID 4164 wrote to memory of 2784 4164 4825.tmp 4892.tmp PID 4164 wrote to memory of 2784 4164 4825.tmp 4892.tmp PID 2784 wrote to memory of 2684 2784 4892.tmp 490F.tmp PID 2784 wrote to memory of 2684 2784 4892.tmp 490F.tmp PID 2784 wrote to memory of 2684 2784 4892.tmp 490F.tmp PID 2684 wrote to memory of 716 2684 490F.tmp 497C.tmp PID 2684 wrote to memory of 716 2684 490F.tmp 497C.tmp PID 2684 wrote to memory of 716 2684 490F.tmp 497C.tmp PID 716 wrote to memory of 2404 716 497C.tmp 49EA.tmp PID 716 wrote to memory of 2404 716 497C.tmp 49EA.tmp PID 716 wrote to memory of 2404 716 497C.tmp 49EA.tmp PID 2404 wrote to memory of 4760 2404 49EA.tmp 4A67.tmp PID 2404 wrote to memory of 4760 2404 49EA.tmp 4A67.tmp PID 2404 wrote to memory of 4760 2404 49EA.tmp 4A67.tmp PID 4760 wrote to memory of 4848 4760 4A67.tmp 4AE4.tmp PID 4760 wrote to memory of 4848 4760 4A67.tmp 4AE4.tmp PID 4760 wrote to memory of 4848 4760 4A67.tmp 4AE4.tmp PID 4848 wrote to memory of 3224 4848 4AE4.tmp 4B70.tmp PID 4848 wrote to memory of 3224 4848 4AE4.tmp 4B70.tmp PID 4848 wrote to memory of 3224 4848 4AE4.tmp 4B70.tmp PID 3224 wrote to memory of 540 3224 4B70.tmp 4BDE.tmp PID 3224 wrote to memory of 540 3224 4B70.tmp 4BDE.tmp PID 3224 wrote to memory of 540 3224 4B70.tmp 4BDE.tmp PID 540 wrote to memory of 4364 540 4BDE.tmp 4C5B.tmp PID 540 wrote to memory of 4364 540 4BDE.tmp 4C5B.tmp PID 540 wrote to memory of 4364 540 4BDE.tmp 4C5B.tmp PID 4364 wrote to memory of 1420 4364 4C5B.tmp 4CB8.tmp PID 4364 wrote to memory of 1420 4364 4C5B.tmp 4CB8.tmp PID 4364 wrote to memory of 1420 4364 4C5B.tmp 4CB8.tmp PID 1420 wrote to memory of 4056 1420 4CB8.tmp 4D55.tmp PID 1420 wrote to memory of 4056 1420 4CB8.tmp 4D55.tmp PID 1420 wrote to memory of 4056 1420 4CB8.tmp 4D55.tmp PID 4056 wrote to memory of 4520 4056 4D55.tmp 4E01.tmp PID 4056 wrote to memory of 4520 4056 4D55.tmp 4E01.tmp PID 4056 wrote to memory of 4520 4056 4D55.tmp 4E01.tmp PID 4520 wrote to memory of 2964 4520 4E01.tmp 4E8D.tmp PID 4520 wrote to memory of 2964 4520 4E01.tmp 4E8D.tmp PID 4520 wrote to memory of 2964 4520 4E01.tmp 4E8D.tmp PID 2964 wrote to memory of 4528 2964 4E8D.tmp 4F39.tmp PID 2964 wrote to memory of 4528 2964 4E8D.tmp 4F39.tmp PID 2964 wrote to memory of 4528 2964 4E8D.tmp 4F39.tmp PID 4528 wrote to memory of 4512 4528 4F39.tmp 4FC6.tmp PID 4528 wrote to memory of 4512 4528 4F39.tmp 4FC6.tmp PID 4528 wrote to memory of 4512 4528 4F39.tmp 4FC6.tmp PID 4512 wrote to memory of 4536 4512 4FC6.tmp 5062.tmp PID 4512 wrote to memory of 4536 4512 4FC6.tmp 5062.tmp PID 4512 wrote to memory of 4536 4512 4FC6.tmp 5062.tmp PID 4536 wrote to memory of 4704 4536 5062.tmp 50FE.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_cba87e5c53c0148bd5929a8c214b36ef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"23⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"24⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"25⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"26⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"27⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"28⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"29⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"30⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"31⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"32⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"33⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"34⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"35⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"36⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"37⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"38⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"39⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"40⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"41⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"42⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"43⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"44⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"45⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"46⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"47⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"48⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"49⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"50⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"51⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"52⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"53⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"54⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"55⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"56⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"57⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"58⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"59⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"60⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"61⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"62⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"63⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"64⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"65⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"66⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"67⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"68⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"69⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"70⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"71⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"72⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"73⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"74⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"75⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"76⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"77⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"78⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"79⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"80⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"81⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"82⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"83⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"84⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"85⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"86⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"87⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"88⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"89⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"90⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"91⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"92⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"93⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"94⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"95⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"96⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"97⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"98⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"99⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"100⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"101⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"102⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"103⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"104⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"105⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"106⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"107⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"108⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"110⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"111⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"112⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"113⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"114⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"115⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"116⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"117⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"118⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"119⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"120⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"121⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"122⤵PID:4248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-