Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe
-
Size
527KB
-
MD5
dfb0ed0d8c16e4e5a1c4124f27d001e3
-
SHA1
0034fe08e378ab86fda7ea6ee9674b3f446e0221
-
SHA256
1715117459f63cf0dfc0a1b2a5ccca42d6fe8af77de44e6f5afae698b4f307ce
-
SHA512
c86c2646c72d604032edf81f8da32c7f77ed7c3ee11e6e2f4d9baeaaabb307545852c3905b63d81564d853ca71446e6f3c863202df16422c0867a6468cac2aea
-
SSDEEP
12288:fU5rCOTeidviWrs+vG40gjO2xlpO63wkvDZu:fUQOJdXsVgjO2xvskvDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 396 6C85.tmp 5040 6CE3.tmp 2356 6D50.tmp 4896 6DCD.tmp 4848 6E3B.tmp 1132 6EA8.tmp 2252 6F25.tmp 404 6FD1.tmp 3096 703E.tmp 4908 70AC.tmp 1900 7148.tmp 2920 71A6.tmp 116 7213.tmp 4220 7271.tmp 4964 72CE.tmp 2668 731D.tmp 1476 738A.tmp 464 7417.tmp 2140 7494.tmp 316 7501.tmp 2800 754F.tmp 4148 759D.tmp 1936 75FB.tmp 2740 7659.tmp 2796 76C6.tmp 4392 7724.tmp 5048 7772.tmp 1528 77EF.tmp 4640 787C.tmp 3188 78E9.tmp 936 7A60.tmp 3332 7AED.tmp 4368 7B6A.tmp 4012 7BC7.tmp 4208 7C25.tmp 4488 7C73.tmp 4044 7CD1.tmp 2544 7D2F.tmp 2636 7D7D.tmp 4256 7DEA.tmp 2528 7E48.tmp 1872 7E96.tmp 4080 7EF4.tmp 1652 7F52.tmp 3412 7FAF.tmp 1140 800D.tmp 2440 806B.tmp 4472 80C9.tmp 676 8117.tmp 2252 8174.tmp 1308 81D2.tmp 4028 8220.tmp 2144 826E.tmp 4852 82CC.tmp 1900 832A.tmp 3008 8388.tmp 1584 83E5.tmp 724 8443.tmp 1712 84A1.tmp 1608 84EF.tmp 456 854D.tmp 4564 859B.tmp 4976 85F9.tmp 632 8656.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 396 5012 2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe 85 PID 5012 wrote to memory of 396 5012 2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe 85 PID 5012 wrote to memory of 396 5012 2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe 85 PID 396 wrote to memory of 5040 396 6C85.tmp 87 PID 396 wrote to memory of 5040 396 6C85.tmp 87 PID 396 wrote to memory of 5040 396 6C85.tmp 87 PID 5040 wrote to memory of 2356 5040 6CE3.tmp 89 PID 5040 wrote to memory of 2356 5040 6CE3.tmp 89 PID 5040 wrote to memory of 2356 5040 6CE3.tmp 89 PID 2356 wrote to memory of 4896 2356 6D50.tmp 90 PID 2356 wrote to memory of 4896 2356 6D50.tmp 90 PID 2356 wrote to memory of 4896 2356 6D50.tmp 90 PID 4896 wrote to memory of 4848 4896 6DCD.tmp 91 PID 4896 wrote to memory of 4848 4896 6DCD.tmp 91 PID 4896 wrote to memory of 4848 4896 6DCD.tmp 91 PID 4848 wrote to memory of 1132 4848 6E3B.tmp 92 PID 4848 wrote to memory of 1132 4848 6E3B.tmp 92 PID 4848 wrote to memory of 1132 4848 6E3B.tmp 92 PID 1132 wrote to memory of 2252 1132 6EA8.tmp 93 PID 1132 wrote to memory of 2252 1132 6EA8.tmp 93 PID 1132 wrote to memory of 2252 1132 6EA8.tmp 93 PID 2252 wrote to memory of 404 2252 6F25.tmp 94 PID 2252 wrote to memory of 404 2252 6F25.tmp 94 PID 2252 wrote to memory of 404 2252 6F25.tmp 94 PID 404 wrote to memory of 3096 404 6FD1.tmp 95 PID 404 wrote to memory of 3096 404 6FD1.tmp 95 PID 404 wrote to memory of 3096 404 6FD1.tmp 95 PID 3096 wrote to memory of 4908 3096 703E.tmp 96 PID 3096 wrote to memory of 4908 3096 703E.tmp 96 PID 3096 wrote to memory of 4908 3096 703E.tmp 96 PID 4908 wrote to memory of 1900 4908 70AC.tmp 97 PID 4908 wrote to memory of 1900 4908 70AC.tmp 97 PID 4908 wrote to memory of 1900 4908 70AC.tmp 97 PID 1900 wrote to memory of 2920 1900 7148.tmp 98 PID 1900 wrote to memory of 2920 1900 7148.tmp 98 PID 1900 wrote to memory of 2920 1900 7148.tmp 98 PID 2920 wrote to memory of 116 2920 71A6.tmp 99 PID 2920 wrote to memory of 116 2920 71A6.tmp 99 PID 2920 wrote to memory of 116 2920 71A6.tmp 99 PID 116 wrote to memory of 4220 116 7213.tmp 100 PID 116 wrote to memory of 4220 116 7213.tmp 100 PID 116 wrote to memory of 4220 116 7213.tmp 100 PID 4220 wrote to memory of 4964 4220 7271.tmp 101 PID 4220 wrote to memory of 4964 4220 7271.tmp 101 PID 4220 wrote to memory of 4964 4220 7271.tmp 101 PID 4964 wrote to memory of 2668 4964 72CE.tmp 102 PID 4964 wrote to memory of 2668 4964 72CE.tmp 102 PID 4964 wrote to memory of 2668 4964 72CE.tmp 102 PID 2668 wrote to memory of 1476 2668 731D.tmp 103 PID 2668 wrote to memory of 1476 2668 731D.tmp 103 PID 2668 wrote to memory of 1476 2668 731D.tmp 103 PID 1476 wrote to memory of 464 1476 738A.tmp 104 PID 1476 wrote to memory of 464 1476 738A.tmp 104 PID 1476 wrote to memory of 464 1476 738A.tmp 104 PID 464 wrote to memory of 2140 464 7417.tmp 105 PID 464 wrote to memory of 2140 464 7417.tmp 105 PID 464 wrote to memory of 2140 464 7417.tmp 105 PID 2140 wrote to memory of 316 2140 7494.tmp 106 PID 2140 wrote to memory of 316 2140 7494.tmp 106 PID 2140 wrote to memory of 316 2140 7494.tmp 106 PID 316 wrote to memory of 2800 316 7501.tmp 107 PID 316 wrote to memory of 2800 316 7501.tmp 107 PID 316 wrote to memory of 2800 316 7501.tmp 107 PID 2800 wrote to memory of 4148 2800 754F.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_dfb0ed0d8c16e4e5a1c4124f27d001e3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"23⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"24⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"25⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"26⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"27⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"28⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"29⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"30⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"31⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"32⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"33⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"34⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"35⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"36⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"37⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"38⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"39⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"40⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"41⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"42⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"43⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"44⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"45⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"46⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"47⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"48⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"49⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"50⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"51⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"52⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"53⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"54⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"55⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"56⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"57⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"58⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"59⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"60⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"61⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"62⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"63⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"64⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"65⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"66⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"67⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"68⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"69⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"70⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"71⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"72⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"73⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"74⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"75⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"76⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"77⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"78⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"79⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"80⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"81⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"82⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"83⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"84⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"85⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"86⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"87⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"88⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"89⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"90⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"92⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"93⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"94⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"95⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"96⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"97⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"98⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"99⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"100⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"101⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"102⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"103⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"104⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"105⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"106⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"107⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"108⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"109⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"110⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"111⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"112⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"113⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"114⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"115⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"116⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"117⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"118⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"119⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"120⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"121⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"122⤵PID:3736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-