Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 23:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe
-
Size
541KB
-
MD5
937719071dec4e7c5aa3b7c5c83badfa
-
SHA1
ec5fb6d8a0a8bc46e8267ed0f31762d5d96e95e6
-
SHA256
b93fa62dcfde81bd9df74b1a3f8e778c265265cd0dc1239f8a0ff06f97a40dd1
-
SHA512
0c4f166846c73b73428a10acc20e61466629bbd0b9335f514a8af2ac94697aba1174e751d2a9bedc78372b37e6694bc06998cc996845836b519727615c54f649
-
SSDEEP
12288:UU5rCOTeif/jqw6ihWlKQ9Aqdh7UlQ5srZa73ctO:UUQOJf/FJkKOrYbrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4852 417D.tmp 2124 41EB.tmp 3012 4268.tmp 1816 4304.tmp 1332 4391.tmp 4992 440E.tmp 3524 448B.tmp 540 44F8.tmp 4356 4575.tmp 2084 45E2.tmp 5084 4631.tmp 3932 468E.tmp 3844 46FC.tmp 5080 4759.tmp 4688 47B7.tmp 4576 4815.tmp 2760 4863.tmp 1776 48E0.tmp 4292 493E.tmp 4384 498C.tmp 4792 49DA.tmp 1904 4A38.tmp 4800 4A86.tmp 624 4AE4.tmp 636 4B51.tmp 3904 4BAF.tmp 2672 4C2C.tmp 3588 4CA9.tmp 1640 4D07.tmp 1596 4D55.tmp 3364 4DC2.tmp 1516 4E20.tmp 4472 4E7E.tmp 3480 4ECC.tmp 1752 4F1A.tmp 3196 4F78.tmp 2540 4FC6.tmp 4808 5014.tmp 1364 5072.tmp 4888 50C0.tmp 3436 510E.tmp 4960 515C.tmp 4312 51BA.tmp 3500 5217.tmp 3104 5275.tmp 4440 52D3.tmp 3924 5331.tmp 3092 538E.tmp 3572 53EC.tmp 3392 544A.tmp 2944 54A8.tmp 2000 564E.tmp 4220 56AB.tmp 3360 5709.tmp 4788 5767.tmp 1932 57C5.tmp 4588 5822.tmp 648 5880.tmp 1792 58DE.tmp 4532 592C.tmp 4356 598A.tmp 1736 59E7.tmp 2996 5A45.tmp 4560 5AA3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4852 3104 2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe 82 PID 3104 wrote to memory of 4852 3104 2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe 82 PID 3104 wrote to memory of 4852 3104 2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe 82 PID 4852 wrote to memory of 2124 4852 417D.tmp 83 PID 4852 wrote to memory of 2124 4852 417D.tmp 83 PID 4852 wrote to memory of 2124 4852 417D.tmp 83 PID 2124 wrote to memory of 3012 2124 41EB.tmp 86 PID 2124 wrote to memory of 3012 2124 41EB.tmp 86 PID 2124 wrote to memory of 3012 2124 41EB.tmp 86 PID 3012 wrote to memory of 1816 3012 4268.tmp 87 PID 3012 wrote to memory of 1816 3012 4268.tmp 87 PID 3012 wrote to memory of 1816 3012 4268.tmp 87 PID 1816 wrote to memory of 1332 1816 4304.tmp 89 PID 1816 wrote to memory of 1332 1816 4304.tmp 89 PID 1816 wrote to memory of 1332 1816 4304.tmp 89 PID 1332 wrote to memory of 4992 1332 4391.tmp 90 PID 1332 wrote to memory of 4992 1332 4391.tmp 90 PID 1332 wrote to memory of 4992 1332 4391.tmp 90 PID 4992 wrote to memory of 3524 4992 440E.tmp 91 PID 4992 wrote to memory of 3524 4992 440E.tmp 91 PID 4992 wrote to memory of 3524 4992 440E.tmp 91 PID 3524 wrote to memory of 540 3524 448B.tmp 92 PID 3524 wrote to memory of 540 3524 448B.tmp 92 PID 3524 wrote to memory of 540 3524 448B.tmp 92 PID 540 wrote to memory of 4356 540 44F8.tmp 93 PID 540 wrote to memory of 4356 540 44F8.tmp 93 PID 540 wrote to memory of 4356 540 44F8.tmp 93 PID 4356 wrote to memory of 2084 4356 4575.tmp 94 PID 4356 wrote to memory of 2084 4356 4575.tmp 94 PID 4356 wrote to memory of 2084 4356 4575.tmp 94 PID 2084 wrote to memory of 5084 2084 45E2.tmp 95 PID 2084 wrote to memory of 5084 2084 45E2.tmp 95 PID 2084 wrote to memory of 5084 2084 45E2.tmp 95 PID 5084 wrote to memory of 3932 5084 4631.tmp 96 PID 5084 wrote to memory of 3932 5084 4631.tmp 96 PID 5084 wrote to memory of 3932 5084 4631.tmp 96 PID 3932 wrote to memory of 3844 3932 468E.tmp 97 PID 3932 wrote to memory of 3844 3932 468E.tmp 97 PID 3932 wrote to memory of 3844 3932 468E.tmp 97 PID 3844 wrote to memory of 5080 3844 46FC.tmp 98 PID 3844 wrote to memory of 5080 3844 46FC.tmp 98 PID 3844 wrote to memory of 5080 3844 46FC.tmp 98 PID 5080 wrote to memory of 4688 5080 4759.tmp 99 PID 5080 wrote to memory of 4688 5080 4759.tmp 99 PID 5080 wrote to memory of 4688 5080 4759.tmp 99 PID 4688 wrote to memory of 4576 4688 47B7.tmp 100 PID 4688 wrote to memory of 4576 4688 47B7.tmp 100 PID 4688 wrote to memory of 4576 4688 47B7.tmp 100 PID 4576 wrote to memory of 2760 4576 4815.tmp 101 PID 4576 wrote to memory of 2760 4576 4815.tmp 101 PID 4576 wrote to memory of 2760 4576 4815.tmp 101 PID 2760 wrote to memory of 1776 2760 4863.tmp 102 PID 2760 wrote to memory of 1776 2760 4863.tmp 102 PID 2760 wrote to memory of 1776 2760 4863.tmp 102 PID 1776 wrote to memory of 4292 1776 48E0.tmp 103 PID 1776 wrote to memory of 4292 1776 48E0.tmp 103 PID 1776 wrote to memory of 4292 1776 48E0.tmp 103 PID 4292 wrote to memory of 4384 4292 493E.tmp 104 PID 4292 wrote to memory of 4384 4292 493E.tmp 104 PID 4292 wrote to memory of 4384 4292 493E.tmp 104 PID 4384 wrote to memory of 4792 4384 498C.tmp 105 PID 4384 wrote to memory of 4792 4384 498C.tmp 105 PID 4384 wrote to memory of 4792 4384 498C.tmp 105 PID 4792 wrote to memory of 1904 4792 49DA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_937719071dec4e7c5aa3b7c5c83badfa_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"23⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"24⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"25⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"26⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"27⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"28⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"29⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"30⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"31⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"32⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"33⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"34⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"35⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"36⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"37⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"38⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"39⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"40⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"41⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"42⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"43⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"44⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"45⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"46⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"47⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"48⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"49⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"50⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"51⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"52⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"53⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"54⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"55⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"56⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"57⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"58⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"59⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"60⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"61⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"62⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"63⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"64⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"65⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"66⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"67⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"68⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"69⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"70⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"71⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"72⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"73⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"74⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"75⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"77⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"78⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"79⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"80⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"81⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"82⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"83⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"84⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"85⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"86⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"87⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"88⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"89⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"90⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"91⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"92⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"93⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"94⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"95⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"96⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"97⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"98⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"99⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"100⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"102⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"103⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"104⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"105⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"106⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"107⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"108⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"109⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"110⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"111⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"112⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"113⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"114⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"115⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"116⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"117⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"119⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"121⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"122⤵PID:3972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-