Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
- Target 2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe
- Size 536KB
- Sample240602-2cbpnsac93
- SHA256 89d674202b5ae5b882988249d50acd56dca92baf1d420a03877b81d3d190af6f
- MD5 dd0b76393897939668627877fda53e3c
- SHA1 7b6429a3438f7d6766df03cbd0fb579d526a048f
- SHA512 fc1a72e013a5ec0a36015b413f3ededc2113073c69311fd7b5cfe2f9484ba5be7381333ab3add9142e611df5ad4747cc6cb3b4780b0b887ad5601072f0dbede8
- SSDEEP 12288:wU5rCOTeiUgUuy8Y9wQ8kufmflLWf6346IZxVJ0ZT9:wUQOJUuy8IwkWm2M46IRJ0ZT9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 688 419D.tmp 3712 4229.tmp 908 4277.tmp 2568 42F4.tmp 3648 4352.tmp 1220 43A0.tmp 4984 440E.tmp 3396 446B.tmp 4668 44BA.tmp 3288 4517.tmp 3148 45B4.tmp 3880 4611.tmp 3556 467F.tmp 3000 46DC.tmp 4112 473A.tmp 772 47C7.tmp 932 4825.tmp 4072 4882.tmp 3568 48D0.tmp 4952 497C.tmp 2896 49CA.tmp 408 4A28.tmp 2920 4A96.tmp 1628 4B22.tmp 2780 4B9F.tmp 1836 4C1C.tmp 3996 4C7A.tmp 4744 4CC8.tmp 3512 4D26.tmp 4140 4D84.tmp 1256 4DF1.tmp 1036 4E4F.tmp 3772 4EAC.tmp 4660 4EFB.tmp 3344 4F68.tmp 3028 4FB6.tmp 2356 5014.tmp 2044 5072.tmp 4424 50C0.tmp 1192 511D.tmp 4568 517B.tmp 4256 51D9.tmp 1772 5227.tmp 1100 5275.tmp 2080 52C3.tmp 1472 5321.tmp 4040 536F.tmp 5052 53FC.tmp 4656 545A.tmp 2712 54B7.tmp 2636 5515.tmp 3880 5563.tmp 2664 55B1.tmp 384 55FF.tmp 5080 564E.tmp 1408 56AB.tmp 1692 5709.tmp 3384 5757.tmp 1276 57A5.tmp 4888 57F3.tmp 3568 5842.tmp 4952 5890.tmp 2896 58DE.tmp 1652 592C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 688 2004 2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe 81 PID 2004 wrote to memory of 688 2004 2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe 81 PID 2004 wrote to memory of 688 2004 2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe 81 PID 688 wrote to memory of 3712 688 419D.tmp 82 PID 688 wrote to memory of 3712 688 419D.tmp 82 PID 688 wrote to memory of 3712 688 419D.tmp 82 PID 3712 wrote to memory of 908 3712 4229.tmp 175 PID 3712 wrote to memory of 908 3712 4229.tmp 175 PID 3712 wrote to memory of 908 3712 4229.tmp 175 PID 908 wrote to memory of 2568 908 4277.tmp 87 PID 908 wrote to memory of 2568 908 4277.tmp 87 PID 908 wrote to memory of 2568 908 4277.tmp 87 PID 2568 wrote to memory of 3648 2568 42F4.tmp 88 PID 2568 wrote to memory of 3648 2568 42F4.tmp 88 PID 2568 wrote to memory of 3648 2568 42F4.tmp 88 PID 3648 wrote to memory of 1220 3648 4352.tmp 177 PID 3648 wrote to memory of 1220 3648 4352.tmp 177 PID 3648 wrote to memory of 1220 3648 4352.tmp 177 PID 1220 wrote to memory of 4984 1220 43A0.tmp 90 PID 1220 wrote to memory of 4984 1220 43A0.tmp 90 PID 1220 wrote to memory of 4984 1220 43A0.tmp 90 PID 4984 wrote to memory of 3396 4984 440E.tmp 91 PID 4984 wrote to memory of 3396 4984 440E.tmp 91 PID 4984 wrote to memory of 3396 4984 440E.tmp 91 PID 3396 wrote to memory of 4668 3396 446B.tmp 92 PID 3396 wrote to memory of 4668 3396 446B.tmp 92 PID 3396 wrote to memory of 4668 3396 446B.tmp 92 PID 4668 wrote to memory of 3288 4668 44BA.tmp 182 PID 4668 wrote to memory of 3288 4668 44BA.tmp 182 PID 4668 wrote to memory of 3288 4668 44BA.tmp 182 PID 3288 wrote to memory of 3148 3288 4517.tmp 94 PID 3288 wrote to memory of 3148 3288 4517.tmp 94 PID 3288 wrote to memory of 3148 3288 4517.tmp 94 PID 3148 wrote to memory of 3880 3148 45B4.tmp 95 PID 3148 wrote to memory of 3880 3148 45B4.tmp 95 PID 3148 wrote to memory of 3880 3148 45B4.tmp 95 PID 3880 wrote to memory of 3556 3880 4611.tmp 96 PID 3880 wrote to memory of 3556 3880 4611.tmp 96 PID 3880 wrote to memory of 3556 3880 4611.tmp 96 PID 3556 wrote to memory of 3000 3556 467F.tmp 97 PID 3556 wrote to memory of 3000 3556 467F.tmp 97 PID 3556 wrote to memory of 3000 3556 467F.tmp 97 PID 3000 wrote to memory of 4112 3000 46DC.tmp 98 PID 3000 wrote to memory of 4112 3000 46DC.tmp 98 PID 3000 wrote to memory of 4112 3000 46DC.tmp 98 PID 4112 wrote to memory of 772 4112 473A.tmp 99 PID 4112 wrote to memory of 772 4112 473A.tmp 99 PID 4112 wrote to memory of 772 4112 473A.tmp 99 PID 772 wrote to memory of 932 772 47C7.tmp 100 PID 772 wrote to memory of 932 772 47C7.tmp 100 PID 772 wrote to memory of 932 772 47C7.tmp 100 PID 932 wrote to memory of 4072 932 4825.tmp 101 PID 932 wrote to memory of 4072 932 4825.tmp 101 PID 932 wrote to memory of 4072 932 4825.tmp 101 PID 4072 wrote to memory of 3568 4072 4882.tmp 197 PID 4072 wrote to memory of 3568 4072 4882.tmp 197 PID 4072 wrote to memory of 3568 4072 4882.tmp 197 PID 3568 wrote to memory of 4952 3568 48D0.tmp 198 PID 3568 wrote to memory of 4952 3568 48D0.tmp 198 PID 3568 wrote to memory of 4952 3568 48D0.tmp 198 PID 4952 wrote to memory of 2896 4952 497C.tmp 150 PID 4952 wrote to memory of 2896 4952 497C.tmp 150 PID 4952 wrote to memory of 2896 4952 497C.tmp 150 PID 2896 wrote to memory of 408 2896 49CA.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_dd0b76393897939668627877fda53e3c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"23⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"24⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"25⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"26⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"27⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"28⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"29⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"30⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"31⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"32⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"33⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"34⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"35⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"36⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"37⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"38⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"39⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"40⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"41⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"42⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"43⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"44⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"45⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"46⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"47⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"48⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"49⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"50⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"51⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"52⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"53⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"54⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"55⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"56⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"58⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"59⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"60⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"61⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"62⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"63⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"64⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"65⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"66⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"67⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"68⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"69⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"70⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"71⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"72⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"73⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"74⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"75⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"76⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"77⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"78⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"79⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"80⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"81⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"82⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"83⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"84⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"85⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"86⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"87⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"88⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"89⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"90⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"91⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"92⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"93⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"94⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"95⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"96⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"97⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"98⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"99⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"100⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"101⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"102⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"103⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"104⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"105⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"106⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"107⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"108⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"109⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"110⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"111⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"112⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"113⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"114⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"115⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"116⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"117⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"119⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"120⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"121⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-