Analysis
- max time kernel
150s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
- Target 2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe
- Size 520KB
- Sample240613-btff3syglg
- SHA256 6ec8bee2630db21e1c06b65c09c4577b95b15a30a926146086586cd11951a02f
- MD5 239a7f3b284083431949d1565bda834d
- SHA1 8041ce2d3942a7c0c743203c2389243bb65ee41a
- SHA512 b70c961e70765b88367d2d7abb209f8240457d536b86344bace11a21086520ded317a544f987ae1c69cf2eb5c5c803f091bcf4f81097a0fc254bfd5134bb042a
- SSDEEP 12288:gj8fuxR21t5i8fCJR/TZf5wALAVfejcAT/RdNZ:gj8fuK1GYMR/TZfS7mVT/RdN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1384 5E8B.tmp 1160 5F46.tmp 3696 5FE3.tmp 3756 609E.tmp 4024 611B.tmp 3616 6198.tmp 1468 6244.tmp 3772 62C1.tmp 2704 632E.tmp 2864 63BB.tmp 2820 6457.tmp 4088 64C5.tmp 2312 6551.tmp 4376 65EE.tmp 1584 665B.tmp 1104 66C8.tmp 2080 6726.tmp 4080 6793.tmp 992 6820.tmp 1304 687E.tmp 816 691A.tmp 1252 69B6.tmp 948 6A14.tmp 3464 6AB0.tmp 3456 6B0E.tmp 1292 6B7B.tmp 404 6BF8.tmp 5084 6C95.tmp 2064 6D12.tmp 1504 6D8F.tmp 4648 6DFC.tmp 2696 6E69.tmp 4280 6EE6.tmp 4692 6F54.tmp 1932 6FB2.tmp 4652 7000.tmp 1636 704E.tmp 4636 70AC.tmp 1324 7109.tmp 1456 7167.tmp 3272 71B5.tmp 3104 7213.tmp 4472 7271.tmp 1160 72CE.tmp 4644 732C.tmp 812 737A.tmp 2880 73D8.tmp 1632 7426.tmp 2092 7484.tmp 3368 74D2.tmp 5012 7530.tmp 2276 759D.tmp 1764 75FB.tmp 5112 7649.tmp 3772 76B6.tmp 4724 7724.tmp 4704 7791.tmp 3300 77EF.tmp 4064 784D.tmp 1136 78AA.tmp 3972 7918.tmp 2268 7966.tmp 460 79C4.tmp 4376 7A21.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1384 2716 2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe 82 PID 2716 wrote to memory of 1384 2716 2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe 82 PID 2716 wrote to memory of 1384 2716 2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe 82 PID 1384 wrote to memory of 1160 1384 5E8B.tmp 84 PID 1384 wrote to memory of 1160 1384 5E8B.tmp 84 PID 1384 wrote to memory of 1160 1384 5E8B.tmp 84 PID 1160 wrote to memory of 3696 1160 5F46.tmp 86 PID 1160 wrote to memory of 3696 1160 5F46.tmp 86 PID 1160 wrote to memory of 3696 1160 5F46.tmp 86 PID 3696 wrote to memory of 3756 3696 5FE3.tmp 88 PID 3696 wrote to memory of 3756 3696 5FE3.tmp 88 PID 3696 wrote to memory of 3756 3696 5FE3.tmp 88 PID 3756 wrote to memory of 4024 3756 609E.tmp 89 PID 3756 wrote to memory of 4024 3756 609E.tmp 89 PID 3756 wrote to memory of 4024 3756 609E.tmp 89 PID 4024 wrote to memory of 3616 4024 611B.tmp 90 PID 4024 wrote to memory of 3616 4024 611B.tmp 90 PID 4024 wrote to memory of 3616 4024 611B.tmp 90 PID 3616 wrote to memory of 1468 3616 6198.tmp 91 PID 3616 wrote to memory of 1468 3616 6198.tmp 91 PID 3616 wrote to memory of 1468 3616 6198.tmp 91 PID 1468 wrote to memory of 3772 1468 6244.tmp 92 PID 1468 wrote to memory of 3772 1468 6244.tmp 92 PID 1468 wrote to memory of 3772 1468 6244.tmp 92 PID 3772 wrote to memory of 2704 3772 62C1.tmp 93 PID 3772 wrote to memory of 2704 3772 62C1.tmp 93 PID 3772 wrote to memory of 2704 3772 62C1.tmp 93 PID 2704 wrote to memory of 2864 2704 632E.tmp 94 PID 2704 wrote to memory of 2864 2704 632E.tmp 94 PID 2704 wrote to memory of 2864 2704 632E.tmp 94 PID 2864 wrote to memory of 2820 2864 63BB.tmp 95 PID 2864 wrote to memory of 2820 2864 63BB.tmp 95 PID 2864 wrote to memory of 2820 2864 63BB.tmp 95 PID 2820 wrote to memory of 4088 2820 6457.tmp 96 PID 2820 wrote to memory of 4088 2820 6457.tmp 96 PID 2820 wrote to memory of 4088 2820 6457.tmp 96 PID 4088 wrote to memory of 2312 4088 64C5.tmp 97 PID 4088 wrote to memory of 2312 4088 64C5.tmp 97 PID 4088 wrote to memory of 2312 4088 64C5.tmp 97 PID 2312 wrote to memory of 4376 2312 6551.tmp 98 PID 2312 wrote to memory of 4376 2312 6551.tmp 98 PID 2312 wrote to memory of 4376 2312 6551.tmp 98 PID 4376 wrote to memory of 1584 4376 65EE.tmp 100 PID 4376 wrote to memory of 1584 4376 65EE.tmp 100 PID 4376 wrote to memory of 1584 4376 65EE.tmp 100 PID 1584 wrote to memory of 1104 1584 665B.tmp 101 PID 1584 wrote to memory of 1104 1584 665B.tmp 101 PID 1584 wrote to memory of 1104 1584 665B.tmp 101 PID 1104 wrote to memory of 2080 1104 66C8.tmp 102 PID 1104 wrote to memory of 2080 1104 66C8.tmp 102 PID 1104 wrote to memory of 2080 1104 66C8.tmp 102 PID 2080 wrote to memory of 4080 2080 6726.tmp 103 PID 2080 wrote to memory of 4080 2080 6726.tmp 103 PID 2080 wrote to memory of 4080 2080 6726.tmp 103 PID 4080 wrote to memory of 992 4080 6793.tmp 105 PID 4080 wrote to memory of 992 4080 6793.tmp 105 PID 4080 wrote to memory of 992 4080 6793.tmp 105 PID 992 wrote to memory of 1304 992 6820.tmp 106 PID 992 wrote to memory of 1304 992 6820.tmp 106 PID 992 wrote to memory of 1304 992 6820.tmp 106 PID 1304 wrote to memory of 816 1304 687E.tmp 107 PID 1304 wrote to memory of 816 1304 687E.tmp 107 PID 1304 wrote to memory of 816 1304 687E.tmp 107 PID 816 wrote to memory of 1252 816 691A.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_239a7f3b284083431949d1565bda834d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"23⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"24⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"25⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"26⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"27⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"28⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"29⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"30⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"31⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"32⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"33⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"34⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"35⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"36⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"37⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"38⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"39⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"40⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"41⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"42⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"43⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"44⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"45⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"46⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"47⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"48⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"49⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"50⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"51⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"52⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"53⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"54⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"55⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"56⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"57⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"58⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"59⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"60⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"61⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"62⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"63⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"64⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"65⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"66⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"67⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"68⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"69⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"71⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"72⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"73⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"74⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"75⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"76⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"77⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"78⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"79⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"80⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"81⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"82⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"83⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"84⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"85⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"86⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"87⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"88⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"89⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"90⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"91⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"92⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"93⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"94⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"95⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"96⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"98⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"99⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"100⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"101⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"102⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"103⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"105⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"106⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"107⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"108⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"109⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"110⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"111⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"112⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"114⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"115⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"116⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"117⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"118⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"120⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"121⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"122⤵PID:768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-