Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
-
Size
520KB
-
MD5
c220c354646de36d9762158e9391b1e1
-
SHA1
aed29929663fd37c6d24a10c9fe4b85d970f7215
-
SHA256
5956d54244197fc341dd96f41ed300548f0827657027f3633df6da851bd859ed
-
SHA512
57b8ebffeea75e4c1b6d44088d29b7b76f5e3676d4f7fccefa1b3d7f4c2a52727aa744983869fad34e7552e980d2332c71e478adb6d10791bcdaa68ad1ad5119
-
SSDEEP
12288:roRXOQjmOyIwckp3JEm7XhO/ziSSZJK32GNZ:rogQ9yIwDp3JEm7MriSuK32GN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3796 69A7.tmp 3132 6A04.tmp 1348 6A72.tmp 4740 6AD0.tmp 3648 6B3D.tmp 3760 6B9B.tmp 4328 6BE9.tmp 2164 6DAE.tmp 4600 6E0C.tmp 228 6E69.tmp 2224 6EC7.tmp 460 6F15.tmp 1620 6F83.tmp 4840 6FF0.tmp 1380 703E.tmp 2360 709C.tmp 3700 70FA.tmp 1032 7157.tmp 3420 71A6.tmp 116 7203.tmp 3488 7251.tmp 1356 72AF.tmp 1212 72FD.tmp 4004 734B.tmp 1352 73A9.tmp 4620 7407.tmp 60 7455.tmp 4944 74A3.tmp 3684 74F1.tmp 5028 7530.tmp 2312 757E.tmp 4216 75DC.tmp 3436 761A.tmp 4444 7668.tmp 4928 76E5.tmp 3496 7762.tmp 3628 77C0.tmp 3588 780E.tmp 4728 788B.tmp 1112 78E9.tmp 2868 7947.tmp 1376 79A4.tmp 1424 79F3.tmp 3564 7A50.tmp 3708 7AAE.tmp 2648 7AFC.tmp 2340 7B5A.tmp 2924 7BB8.tmp 2228 7C25.tmp 3932 7C83.tmp 792 7CF0.tmp 2432 7D5E.tmp 4448 7DAC.tmp 4596 7E09.tmp 4600 7E58.tmp 2456 7EA6.tmp 4748 7F03.tmp 4244 7F61.tmp 1512 7FBF.tmp 3856 800D.tmp 4764 806B.tmp 4732 80C9.tmp 876 8126.tmp 4584 8194.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 3796 1340 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 84 PID 1340 wrote to memory of 3796 1340 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 84 PID 1340 wrote to memory of 3796 1340 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 84 PID 3796 wrote to memory of 3132 3796 69A7.tmp 86 PID 3796 wrote to memory of 3132 3796 69A7.tmp 86 PID 3796 wrote to memory of 3132 3796 69A7.tmp 86 PID 3132 wrote to memory of 1348 3132 6A04.tmp 88 PID 3132 wrote to memory of 1348 3132 6A04.tmp 88 PID 3132 wrote to memory of 1348 3132 6A04.tmp 88 PID 1348 wrote to memory of 4740 1348 6A72.tmp 90 PID 1348 wrote to memory of 4740 1348 6A72.tmp 90 PID 1348 wrote to memory of 4740 1348 6A72.tmp 90 PID 4740 wrote to memory of 3648 4740 6AD0.tmp 91 PID 4740 wrote to memory of 3648 4740 6AD0.tmp 91 PID 4740 wrote to memory of 3648 4740 6AD0.tmp 91 PID 3648 wrote to memory of 3760 3648 6B3D.tmp 92 PID 3648 wrote to memory of 3760 3648 6B3D.tmp 92 PID 3648 wrote to memory of 3760 3648 6B3D.tmp 92 PID 3760 wrote to memory of 4328 3760 6B9B.tmp 93 PID 3760 wrote to memory of 4328 3760 6B9B.tmp 93 PID 3760 wrote to memory of 4328 3760 6B9B.tmp 93 PID 4328 wrote to memory of 2164 4328 6BE9.tmp 94 PID 4328 wrote to memory of 2164 4328 6BE9.tmp 94 PID 4328 wrote to memory of 2164 4328 6BE9.tmp 94 PID 2164 wrote to memory of 4600 2164 6DAE.tmp 95 PID 2164 wrote to memory of 4600 2164 6DAE.tmp 95 PID 2164 wrote to memory of 4600 2164 6DAE.tmp 95 PID 4600 wrote to memory of 228 4600 6E0C.tmp 96 PID 4600 wrote to memory of 228 4600 6E0C.tmp 96 PID 4600 wrote to memory of 228 4600 6E0C.tmp 96 PID 228 wrote to memory of 2224 228 6E69.tmp 97 PID 228 wrote to memory of 2224 228 6E69.tmp 97 PID 228 wrote to memory of 2224 228 6E69.tmp 97 PID 2224 wrote to memory of 460 2224 6EC7.tmp 98 PID 2224 wrote to memory of 460 2224 6EC7.tmp 98 PID 2224 wrote to memory of 460 2224 6EC7.tmp 98 PID 460 wrote to memory of 1620 460 6F15.tmp 99 PID 460 wrote to memory of 1620 460 6F15.tmp 99 PID 460 wrote to memory of 1620 460 6F15.tmp 99 PID 1620 wrote to memory of 4840 1620 6F83.tmp 100 PID 1620 wrote to memory of 4840 1620 6F83.tmp 100 PID 1620 wrote to memory of 4840 1620 6F83.tmp 100 PID 4840 wrote to memory of 1380 4840 6FF0.tmp 101 PID 4840 wrote to memory of 1380 4840 6FF0.tmp 101 PID 4840 wrote to memory of 1380 4840 6FF0.tmp 101 PID 1380 wrote to memory of 2360 1380 703E.tmp 102 PID 1380 wrote to memory of 2360 1380 703E.tmp 102 PID 1380 wrote to memory of 2360 1380 703E.tmp 102 PID 2360 wrote to memory of 3700 2360 709C.tmp 103 PID 2360 wrote to memory of 3700 2360 709C.tmp 103 PID 2360 wrote to memory of 3700 2360 709C.tmp 103 PID 3700 wrote to memory of 1032 3700 70FA.tmp 104 PID 3700 wrote to memory of 1032 3700 70FA.tmp 104 PID 3700 wrote to memory of 1032 3700 70FA.tmp 104 PID 1032 wrote to memory of 3420 1032 7157.tmp 105 PID 1032 wrote to memory of 3420 1032 7157.tmp 105 PID 1032 wrote to memory of 3420 1032 7157.tmp 105 PID 3420 wrote to memory of 116 3420 71A6.tmp 106 PID 3420 wrote to memory of 116 3420 71A6.tmp 106 PID 3420 wrote to memory of 116 3420 71A6.tmp 106 PID 116 wrote to memory of 3488 116 7203.tmp 107 PID 116 wrote to memory of 3488 116 7203.tmp 107 PID 116 wrote to memory of 3488 116 7203.tmp 107 PID 3488 wrote to memory of 1356 3488 7251.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"23⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"24⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"25⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"26⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"27⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"28⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"29⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"30⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"31⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"32⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"33⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"34⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"35⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"36⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"37⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"38⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"39⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"40⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"41⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"42⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"43⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"44⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"45⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"46⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"47⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"48⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"49⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"50⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"51⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"52⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"53⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"54⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"55⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"56⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"57⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"58⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"59⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"60⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"61⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"62⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"63⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"64⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"65⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"66⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"67⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"68⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"69⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"70⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"71⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"72⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"73⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"74⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"75⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"76⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"77⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"78⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"79⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"80⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"81⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"82⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"83⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"84⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"85⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"86⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"87⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"88⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"89⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"90⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"91⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"92⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"93⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"94⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"95⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"96⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"97⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"99⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"100⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"101⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"102⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"103⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"104⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"105⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"106⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"107⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"108⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"109⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"110⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"111⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"112⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"113⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"114⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"115⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"116⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"117⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"118⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"119⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"120⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"121⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"122⤵PID:1536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-