Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
-
Size
520KB
-
MD5
64266d0139de5507a49f0bddbc8fb833
-
SHA1
aa8cd190d693ec81657713cbbb1288598bd1fd87
-
SHA256
e853d1615c27065e641930b440857cd79e4229179a98a72e798bb79fc0de1c98
-
SHA512
4f1e78bdb1f898b1d9c5bbaefc56d5e8a156e5877dfb53c8c013ac5067cb8f240f591996e89145411a4fd7e90bd30c158e28dc9dd213275300be21bc68831aca
-
SSDEEP
12288:gj8fuxR21t5i8fuxrpuahBkODGDTu1e94gNZ:gj8fuK1GYuxdVhtZ1Q5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3612 4268.tmp 1948 42D5.tmp 1576 4333.tmp 940 43B0.tmp 2384 440E.tmp 5324 446B.tmp 3104 44F8.tmp 5000 4546.tmp 1064 45B4.tmp 1984 4621.tmp 5212 468E.tmp 4624 48A2.tmp 2376 492E.tmp 3344 49AB.tmp 4484 4A47.tmp 5448 4AB5.tmp 3716 4B13.tmp 5980 4B80.tmp 1220 4BDE.tmp 5588 4C4B.tmp 5424 4CA9.tmp 840 4D07.tmp 756 4D74.tmp 396 4DD2.tmp 4968 4E3F.tmp 4548 4E9D.tmp 1304 4F1A.tmp 1776 4F78.tmp 2236 4FD5.tmp 5760 5062.tmp 5520 50DF.tmp 3824 513D.tmp 5224 519A.tmp 4228 51E9.tmp 1184 5237.tmp 452 5285.tmp 2200 52D3.tmp 4732 5331.tmp 5468 537F.tmp 4708 53DD.tmp 5316 543A.tmp 3028 5488.tmp 5472 54D7.tmp 1596 5525.tmp 3724 5573.tmp 2020 55C1.tmp 3056 560F.tmp 3896 565D.tmp 1916 56AB.tmp 2532 5709.tmp 6060 5767.tmp 6120 57E4.tmp 1516 5832.tmp 4312 5880.tmp 4488 58CE.tmp 3408 592C.tmp 3928 597A.tmp 3916 59D8.tmp 2524 5A36.tmp 5012 5A84.tmp 684 5AD2.tmp 6104 5B20.tmp 5952 5B7E.tmp 2416 5BDB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3612 3408 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 83 PID 3408 wrote to memory of 3612 3408 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 83 PID 3408 wrote to memory of 3612 3408 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 83 PID 3612 wrote to memory of 1948 3612 4268.tmp 84 PID 3612 wrote to memory of 1948 3612 4268.tmp 84 PID 3612 wrote to memory of 1948 3612 4268.tmp 84 PID 1948 wrote to memory of 1576 1948 42D5.tmp 86 PID 1948 wrote to memory of 1576 1948 42D5.tmp 86 PID 1948 wrote to memory of 1576 1948 42D5.tmp 86 PID 1576 wrote to memory of 940 1576 4333.tmp 88 PID 1576 wrote to memory of 940 1576 4333.tmp 88 PID 1576 wrote to memory of 940 1576 4333.tmp 88 PID 940 wrote to memory of 2384 940 43B0.tmp 89 PID 940 wrote to memory of 2384 940 43B0.tmp 89 PID 940 wrote to memory of 2384 940 43B0.tmp 89 PID 2384 wrote to memory of 5324 2384 440E.tmp 90 PID 2384 wrote to memory of 5324 2384 440E.tmp 90 PID 2384 wrote to memory of 5324 2384 440E.tmp 90 PID 5324 wrote to memory of 3104 5324 446B.tmp 91 PID 5324 wrote to memory of 3104 5324 446B.tmp 91 PID 5324 wrote to memory of 3104 5324 446B.tmp 91 PID 3104 wrote to memory of 5000 3104 44F8.tmp 93 PID 3104 wrote to memory of 5000 3104 44F8.tmp 93 PID 3104 wrote to memory of 5000 3104 44F8.tmp 93 PID 5000 wrote to memory of 1064 5000 4546.tmp 94 PID 5000 wrote to memory of 1064 5000 4546.tmp 94 PID 5000 wrote to memory of 1064 5000 4546.tmp 94 PID 1064 wrote to memory of 1984 1064 45B4.tmp 95 PID 1064 wrote to memory of 1984 1064 45B4.tmp 95 PID 1064 wrote to memory of 1984 1064 45B4.tmp 95 PID 1984 wrote to memory of 5212 1984 4621.tmp 96 PID 1984 wrote to memory of 5212 1984 4621.tmp 96 PID 1984 wrote to memory of 5212 1984 4621.tmp 96 PID 5212 wrote to memory of 4624 5212 468E.tmp 97 PID 5212 wrote to memory of 4624 5212 468E.tmp 97 PID 5212 wrote to memory of 4624 5212 468E.tmp 97 PID 4624 wrote to memory of 2376 4624 48A2.tmp 98 PID 4624 wrote to memory of 2376 4624 48A2.tmp 98 PID 4624 wrote to memory of 2376 4624 48A2.tmp 98 PID 2376 wrote to memory of 3344 2376 492E.tmp 99 PID 2376 wrote to memory of 3344 2376 492E.tmp 99 PID 2376 wrote to memory of 3344 2376 492E.tmp 99 PID 3344 wrote to memory of 4484 3344 49AB.tmp 100 PID 3344 wrote to memory of 4484 3344 49AB.tmp 100 PID 3344 wrote to memory of 4484 3344 49AB.tmp 100 PID 4484 wrote to memory of 5448 4484 4A47.tmp 101 PID 4484 wrote to memory of 5448 4484 4A47.tmp 101 PID 4484 wrote to memory of 5448 4484 4A47.tmp 101 PID 5448 wrote to memory of 3716 5448 4AB5.tmp 102 PID 5448 wrote to memory of 3716 5448 4AB5.tmp 102 PID 5448 wrote to memory of 3716 5448 4AB5.tmp 102 PID 3716 wrote to memory of 5980 3716 4B13.tmp 103 PID 3716 wrote to memory of 5980 3716 4B13.tmp 103 PID 3716 wrote to memory of 5980 3716 4B13.tmp 103 PID 5980 wrote to memory of 1220 5980 4B80.tmp 104 PID 5980 wrote to memory of 1220 5980 4B80.tmp 104 PID 5980 wrote to memory of 1220 5980 4B80.tmp 104 PID 1220 wrote to memory of 5588 1220 4BDE.tmp 105 PID 1220 wrote to memory of 5588 1220 4BDE.tmp 105 PID 1220 wrote to memory of 5588 1220 4BDE.tmp 105 PID 5588 wrote to memory of 5424 5588 4C4B.tmp 106 PID 5588 wrote to memory of 5424 5588 4C4B.tmp 106 PID 5588 wrote to memory of 5424 5588 4C4B.tmp 106 PID 5424 wrote to memory of 840 5424 4CA9.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"23⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"24⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"25⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"26⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"27⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"28⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"29⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"30⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"31⤵
- Executes dropped EXE
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"32⤵
- Executes dropped EXE
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"33⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"34⤵
- Executes dropped EXE
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"35⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"36⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"37⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"38⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"39⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"40⤵
- Executes dropped EXE
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"41⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"42⤵
- Executes dropped EXE
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"43⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"44⤵
- Executes dropped EXE
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"45⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"46⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"47⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"48⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"49⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"50⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"51⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"52⤵
- Executes dropped EXE
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"53⤵
- Executes dropped EXE
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"54⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"55⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"56⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"57⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"58⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"59⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"60⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"61⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"62⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"63⤵
- Executes dropped EXE
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"64⤵
- Executes dropped EXE
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"65⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"66⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"67⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"68⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"69⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"70⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"71⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"72⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"73⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"74⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"75⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"76⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"77⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"78⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"79⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"80⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"81⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"82⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"83⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"84⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"85⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"86⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"87⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"88⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"89⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"90⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"91⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"92⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"93⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"94⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"95⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"96⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"97⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"98⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"99⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"100⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"101⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"102⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"103⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"104⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"105⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"106⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"107⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"108⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"109⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"110⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"111⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"112⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"113⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"114⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"115⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"116⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"117⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"118⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"119⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"120⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"121⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"122⤵PID:5572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-