Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 06:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe
-
Size
520KB
-
MD5
4a25605881074ee8a0c48570e593b828
-
SHA1
a8f2cac71b29a6364ab13777a1c34b8bb8a648dd
-
SHA256
1d27d494427aa45367a716e3cd29d8b666af6a23425942753d40491642d28f5c
-
SHA512
ebaeb1ed47fc5a4559e7235e9613d7967d7338de73d7009897168d307595fc70994b912c46e27b513f4dda59086ae40a5d08ca19900759851d1e5bfa537fa1c1
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL2fx9PhfAueuwmwMXgI/hCKn2Cz3WWWrz38vsz:roRXOQjmOym59Pljwrmp1n2qWVnMUNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4404 441D.tmp 1164 44D9.tmp 3492 4556.tmp 2540 45D3.tmp 1144 4650.tmp 1924 46FC.tmp 2284 47A8.tmp 1876 4805.tmp 4244 4863.tmp 4640 48E0.tmp 3208 495D.tmp 3612 49F9.tmp 4876 4A57.tmp 2892 4AE4.tmp 4580 4B41.tmp 4232 4BCE.tmp 2636 4C4B.tmp 4856 4CA9.tmp 3288 4D26.tmp 3880 4D84.tmp 648 4E20.tmp 736 4ECC.tmp 4872 4F58.tmp 4224 4FB6.tmp 2500 5014.tmp 3832 5091.tmp 396 510E.tmp 1256 518B.tmp 3932 51E9.tmp 5016 5294.tmp 4720 5311.tmp 1380 536F.tmp 400 53EC.tmp 512 544A.tmp 3856 54F6.tmp 4280 5563.tmp 744 55B1.tmp 1164 560F.tmp 888 566D.tmp 920 56CB.tmp 2540 5728.tmp 1696 5776.tmp 3904 57D4.tmp 2608 5842.tmp 1144 589F.tmp 3060 58FD.tmp 4520 594B.tmp 772 5999.tmp 2872 59F7.tmp 3612 5A45.tmp 4468 5A93.tmp 1412 5AF1.tmp 1720 5B3F.tmp 692 5B8D.tmp 2128 5BEB.tmp 1768 5C39.tmp 2432 5C97.tmp 2648 5CF5.tmp 4616 5D62.tmp 2420 5DC0.tmp 1764 5E1E.tmp 3076 5E6C.tmp 3696 5EE9.tmp 1256 5F46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4404 3660 2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe 84 PID 3660 wrote to memory of 4404 3660 2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe 84 PID 3660 wrote to memory of 4404 3660 2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe 84 PID 4404 wrote to memory of 1164 4404 441D.tmp 85 PID 4404 wrote to memory of 1164 4404 441D.tmp 85 PID 4404 wrote to memory of 1164 4404 441D.tmp 85 PID 1164 wrote to memory of 3492 1164 44D9.tmp 87 PID 1164 wrote to memory of 3492 1164 44D9.tmp 87 PID 1164 wrote to memory of 3492 1164 44D9.tmp 87 PID 3492 wrote to memory of 2540 3492 4556.tmp 89 PID 3492 wrote to memory of 2540 3492 4556.tmp 89 PID 3492 wrote to memory of 2540 3492 4556.tmp 89 PID 2540 wrote to memory of 1144 2540 45D3.tmp 90 PID 2540 wrote to memory of 1144 2540 45D3.tmp 90 PID 2540 wrote to memory of 1144 2540 45D3.tmp 90 PID 1144 wrote to memory of 1924 1144 4650.tmp 92 PID 1144 wrote to memory of 1924 1144 4650.tmp 92 PID 1144 wrote to memory of 1924 1144 4650.tmp 92 PID 1924 wrote to memory of 2284 1924 46FC.tmp 93 PID 1924 wrote to memory of 2284 1924 46FC.tmp 93 PID 1924 wrote to memory of 2284 1924 46FC.tmp 93 PID 2284 wrote to memory of 1876 2284 47A8.tmp 95 PID 2284 wrote to memory of 1876 2284 47A8.tmp 95 PID 2284 wrote to memory of 1876 2284 47A8.tmp 95 PID 1876 wrote to memory of 4244 1876 4805.tmp 97 PID 1876 wrote to memory of 4244 1876 4805.tmp 97 PID 1876 wrote to memory of 4244 1876 4805.tmp 97 PID 4244 wrote to memory of 4640 4244 4863.tmp 98 PID 4244 wrote to memory of 4640 4244 4863.tmp 98 PID 4244 wrote to memory of 4640 4244 4863.tmp 98 PID 4640 wrote to memory of 3208 4640 48E0.tmp 99 PID 4640 wrote to memory of 3208 4640 48E0.tmp 99 PID 4640 wrote to memory of 3208 4640 48E0.tmp 99 PID 3208 wrote to memory of 3612 3208 495D.tmp 100 PID 3208 wrote to memory of 3612 3208 495D.tmp 100 PID 3208 wrote to memory of 3612 3208 495D.tmp 100 PID 3612 wrote to memory of 4876 3612 49F9.tmp 101 PID 3612 wrote to memory of 4876 3612 49F9.tmp 101 PID 3612 wrote to memory of 4876 3612 49F9.tmp 101 PID 4876 wrote to memory of 2892 4876 4A57.tmp 102 PID 4876 wrote to memory of 2892 4876 4A57.tmp 102 PID 4876 wrote to memory of 2892 4876 4A57.tmp 102 PID 2892 wrote to memory of 4580 2892 4AE4.tmp 103 PID 2892 wrote to memory of 4580 2892 4AE4.tmp 103 PID 2892 wrote to memory of 4580 2892 4AE4.tmp 103 PID 4580 wrote to memory of 4232 4580 4B41.tmp 104 PID 4580 wrote to memory of 4232 4580 4B41.tmp 104 PID 4580 wrote to memory of 4232 4580 4B41.tmp 104 PID 4232 wrote to memory of 2636 4232 4BCE.tmp 105 PID 4232 wrote to memory of 2636 4232 4BCE.tmp 105 PID 4232 wrote to memory of 2636 4232 4BCE.tmp 105 PID 2636 wrote to memory of 4856 2636 4C4B.tmp 106 PID 2636 wrote to memory of 4856 2636 4C4B.tmp 106 PID 2636 wrote to memory of 4856 2636 4C4B.tmp 106 PID 4856 wrote to memory of 3288 4856 4CA9.tmp 107 PID 4856 wrote to memory of 3288 4856 4CA9.tmp 107 PID 4856 wrote to memory of 3288 4856 4CA9.tmp 107 PID 3288 wrote to memory of 3880 3288 4D26.tmp 108 PID 3288 wrote to memory of 3880 3288 4D26.tmp 108 PID 3288 wrote to memory of 3880 3288 4D26.tmp 108 PID 3880 wrote to memory of 648 3880 4D84.tmp 109 PID 3880 wrote to memory of 648 3880 4D84.tmp 109 PID 3880 wrote to memory of 648 3880 4D84.tmp 109 PID 648 wrote to memory of 736 648 4E20.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_4a25605881074ee8a0c48570e593b828_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"23⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"24⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"25⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"26⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"27⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"28⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"29⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"30⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"32⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"33⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"34⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"35⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"36⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"37⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"38⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"39⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"40⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"41⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"42⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"43⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"44⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"45⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"46⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"47⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"48⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"49⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"50⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"51⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"52⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"53⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"54⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"55⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"56⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"57⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"58⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"59⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"60⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"61⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"62⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"63⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"64⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"65⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"66⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"67⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"68⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"69⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"70⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"71⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"72⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"73⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"74⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"75⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"76⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"77⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"78⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"79⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"80⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"81⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"82⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"83⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"84⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"85⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"86⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"87⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"88⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"89⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"90⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"91⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"92⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"93⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"94⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"95⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"96⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"97⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"98⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"99⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"100⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"101⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"102⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"103⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"104⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"105⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"106⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"107⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"108⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"109⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"110⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"111⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"112⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"113⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"114⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"115⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"116⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"118⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"119⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"120⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"121⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-