Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 07:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe
- Size 520KB
- Sample240609-jnc3rsfg61
- SHA256 e2992b841ef88e4def944c7cb0c564c593256564a08c492d09c4e086db83a3f7
- MD5 470257fcfc6f0fc1150f4d3de5e91a16
- SHA1 53ee7bb0d613dea22eec232db8821d87c828777f
- SHA512 4cf3fdb46c8ecb16bc1d7ac61e505e6d8a89b4fd1a2db6ef0a95122cb5f35badb9a216a6a468fe915008b29f40f24f9af61a653001ad255e7466f2f32fff3478
- SSDEEP 12288:roRXOQjmOyvaz5FiTvVFwCh49mMtURpTNZ:rogQ9yyzDiTrmsBHTN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1852 5EF8.tmp 2400 5F66.tmp 3808 5FD3.tmp 4212 6060.tmp 3516 60EC.tmp 4928 6169.tmp 2604 61E6.tmp 2576 6263.tmp 4032 62C1.tmp 744 632E.tmp 3024 639C.tmp 3688 6409.tmp 2964 6467.tmp 1420 64E4.tmp 3524 6532.tmp 4520 6590.tmp 2564 65EE.tmp 1492 664B.tmp 4044 66D8.tmp 2952 6755.tmp 1884 67A3.tmp 944 6801.tmp 2740 687E.tmp 2288 68EB.tmp 4608 6968.tmp 5112 69E5.tmp 764 6A62.tmp 3332 6ADF.tmp 3852 6B5C.tmp 4476 6BBA.tmp 2032 6C27.tmp 3724 6C95.tmp 4792 6CF2.tmp 372 6D41.tmp 2116 6D8F.tmp 1092 6DDD.tmp 3352 6E2B.tmp 2612 6E79.tmp 2712 6EC7.tmp 544 6F15.tmp 2300 6F63.tmp 3904 6FB2.tmp 3052 700F.tmp 4728 705D.tmp 4828 70AC.tmp 1376 70FA.tmp 4708 7148.tmp 4460 71A6.tmp 2696 71F4.tmp 4400 7251.tmp 4472 72AF.tmp 4900 730D.tmp 4316 735B.tmp 3544 73A9.tmp 1076 73F7.tmp 4984 7455.tmp 4380 74B3.tmp 4080 7501.tmp 3140 754F.tmp 1260 75AD.tmp 4552 760B.tmp 3972 7659.tmp 1288 76A7.tmp 4604 7705.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 1852 4252 2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe 81 PID 4252 wrote to memory of 1852 4252 2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe 81 PID 4252 wrote to memory of 1852 4252 2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe 81 PID 1852 wrote to memory of 2400 1852 5EF8.tmp 82 PID 1852 wrote to memory of 2400 1852 5EF8.tmp 82 PID 1852 wrote to memory of 2400 1852 5EF8.tmp 82 PID 2400 wrote to memory of 3808 2400 5F66.tmp 83 PID 2400 wrote to memory of 3808 2400 5F66.tmp 83 PID 2400 wrote to memory of 3808 2400 5F66.tmp 83 PID 3808 wrote to memory of 4212 3808 5FD3.tmp 84 PID 3808 wrote to memory of 4212 3808 5FD3.tmp 84 PID 3808 wrote to memory of 4212 3808 5FD3.tmp 84 PID 4212 wrote to memory of 3516 4212 6060.tmp 85 PID 4212 wrote to memory of 3516 4212 6060.tmp 85 PID 4212 wrote to memory of 3516 4212 6060.tmp 85 PID 3516 wrote to memory of 4928 3516 60EC.tmp 86 PID 3516 wrote to memory of 4928 3516 60EC.tmp 86 PID 3516 wrote to memory of 4928 3516 60EC.tmp 86 PID 4928 wrote to memory of 2604 4928 6169.tmp 87 PID 4928 wrote to memory of 2604 4928 6169.tmp 87 PID 4928 wrote to memory of 2604 4928 6169.tmp 87 PID 2604 wrote to memory of 2576 2604 61E6.tmp 88 PID 2604 wrote to memory of 2576 2604 61E6.tmp 88 PID 2604 wrote to memory of 2576 2604 61E6.tmp 88 PID 2576 wrote to memory of 4032 2576 6263.tmp 89 PID 2576 wrote to memory of 4032 2576 6263.tmp 89 PID 2576 wrote to memory of 4032 2576 6263.tmp 89 PID 4032 wrote to memory of 744 4032 62C1.tmp 90 PID 4032 wrote to memory of 744 4032 62C1.tmp 90 PID 4032 wrote to memory of 744 4032 62C1.tmp 90 PID 744 wrote to memory of 3024 744 632E.tmp 91 PID 744 wrote to memory of 3024 744 632E.tmp 91 PID 744 wrote to memory of 3024 744 632E.tmp 91 PID 3024 wrote to memory of 3688 3024 639C.tmp 92 PID 3024 wrote to memory of 3688 3024 639C.tmp 92 PID 3024 wrote to memory of 3688 3024 639C.tmp 92 PID 3688 wrote to memory of 2964 3688 6409.tmp 93 PID 3688 wrote to memory of 2964 3688 6409.tmp 93 PID 3688 wrote to memory of 2964 3688 6409.tmp 93 PID 2964 wrote to memory of 1420 2964 6467.tmp 94 PID 2964 wrote to memory of 1420 2964 6467.tmp 94 PID 2964 wrote to memory of 1420 2964 6467.tmp 94 PID 1420 wrote to memory of 3524 1420 64E4.tmp 95 PID 1420 wrote to memory of 3524 1420 64E4.tmp 95 PID 1420 wrote to memory of 3524 1420 64E4.tmp 95 PID 3524 wrote to memory of 4520 3524 6532.tmp 96 PID 3524 wrote to memory of 4520 3524 6532.tmp 96 PID 3524 wrote to memory of 4520 3524 6532.tmp 96 PID 4520 wrote to memory of 2564 4520 6590.tmp 97 PID 4520 wrote to memory of 2564 4520 6590.tmp 97 PID 4520 wrote to memory of 2564 4520 6590.tmp 97 PID 2564 wrote to memory of 1492 2564 65EE.tmp 98 PID 2564 wrote to memory of 1492 2564 65EE.tmp 98 PID 2564 wrote to memory of 1492 2564 65EE.tmp 98 PID 1492 wrote to memory of 4044 1492 664B.tmp 99 PID 1492 wrote to memory of 4044 1492 664B.tmp 99 PID 1492 wrote to memory of 4044 1492 664B.tmp 99 PID 4044 wrote to memory of 2952 4044 66D8.tmp 100 PID 4044 wrote to memory of 2952 4044 66D8.tmp 100 PID 4044 wrote to memory of 2952 4044 66D8.tmp 100 PID 2952 wrote to memory of 1884 2952 6755.tmp 101 PID 2952 wrote to memory of 1884 2952 6755.tmp 101 PID 2952 wrote to memory of 1884 2952 6755.tmp 101 PID 1884 wrote to memory of 944 1884 67A3.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_470257fcfc6f0fc1150f4d3de5e91a16_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"23⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"24⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"25⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"26⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"27⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"28⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"29⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"30⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"31⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"32⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"33⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"34⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"35⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"36⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"37⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"38⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"39⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"40⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"41⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"42⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"43⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"44⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"45⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"46⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"47⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"48⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"49⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"50⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"51⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"53⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"54⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"55⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"56⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"57⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"58⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"59⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"60⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"61⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"62⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"63⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"64⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"65⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"66⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"67⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"68⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"70⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"71⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"72⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"73⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"74⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"75⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"76⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"77⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"78⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"79⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"80⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"81⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"82⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"83⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"84⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"85⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"86⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"87⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"89⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"90⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"91⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"92⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"94⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"95⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"96⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"97⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"98⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"100⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"102⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"103⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"104⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"105⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"106⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"107⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"108⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"109⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"110⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"111⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"112⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"113⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"114⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"115⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"116⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"117⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"118⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"119⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"120⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"121⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-