Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe
-
Size
520KB
-
MD5
8dcc4a041c2d0edfc98cafe271c9ef57
-
SHA1
938b8d1611f2af49ddfebcf618173c8a657c8c27
-
SHA256
ce2e93607b8a7049c1cd0c67ad83fd413f45b31cdb2d18b870a7aa9c45b017f3
-
SHA512
1739028b8208c421c1b419192564adf281c5e0ad87326a39a4867d62f93d9cf436f1fd9129e2b5a4f0ff938f58a938a3c69eba84a4ce942e15a7218266c39fae
-
SSDEEP
12288:roRXOQjmOyP/PRhyfHoGhp2GL3qp5tNZ:rogQ9yP/PRnGhAAqp5tN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1304 4297.tmp 4544 42F4.tmp 3484 4362.tmp 4452 43DF.tmp 3328 444C.tmp 4044 44C9.tmp 2252 4537.tmp 532 4594.tmp 1888 4602.tmp 2628 465F.tmp 3892 46BD.tmp 540 470B.tmp 5036 4779.tmp 4936 4805.tmp 2768 4853.tmp 3524 48C1.tmp 4496 490F.tmp 640 497C.tmp 4404 49DA.tmp 2188 4A38.tmp 4500 4AA5.tmp 3460 4AF3.tmp 2212 4B51.tmp 4508 4BCE.tmp 1848 4C4B.tmp 3000 4CB8.tmp 636 4D26.tmp 3480 4D84.tmp 652 4DE1.tmp 2056 4E4F.tmp 1180 4EBC.tmp 1964 4F0A.tmp 372 4F78.tmp 844 4FC6.tmp 4872 5014.tmp 3468 5062.tmp 4000 50B0.tmp 2300 50FE.tmp 2092 515C.tmp 3828 51AA.tmp 4980 51F8.tmp 4464 5246.tmp 4004 52A4.tmp 2820 52F2.tmp 5008 5340.tmp 4416 538E.tmp 452 53EC.tmp 2836 543A.tmp 2176 5488.tmp 3344 54D7.tmp 3016 5525.tmp 3632 5573.tmp 2068 55C1.tmp 220 561F.tmp 4296 567C.tmp 2668 56CB.tmp 4964 5728.tmp 4748 5786.tmp 3176 57D4.tmp 4544 5822.tmp 2860 5880.tmp 2304 58DE.tmp 3572 592C.tmp 1752 597A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 1304 4852 2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe 83 PID 4852 wrote to memory of 1304 4852 2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe 83 PID 4852 wrote to memory of 1304 4852 2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe 83 PID 1304 wrote to memory of 4544 1304 4297.tmp 84 PID 1304 wrote to memory of 4544 1304 4297.tmp 84 PID 1304 wrote to memory of 4544 1304 4297.tmp 84 PID 4544 wrote to memory of 3484 4544 42F4.tmp 85 PID 4544 wrote to memory of 3484 4544 42F4.tmp 85 PID 4544 wrote to memory of 3484 4544 42F4.tmp 85 PID 3484 wrote to memory of 4452 3484 4362.tmp 87 PID 3484 wrote to memory of 4452 3484 4362.tmp 87 PID 3484 wrote to memory of 4452 3484 4362.tmp 87 PID 4452 wrote to memory of 3328 4452 43DF.tmp 88 PID 4452 wrote to memory of 3328 4452 43DF.tmp 88 PID 4452 wrote to memory of 3328 4452 43DF.tmp 88 PID 3328 wrote to memory of 4044 3328 444C.tmp 89 PID 3328 wrote to memory of 4044 3328 444C.tmp 89 PID 3328 wrote to memory of 4044 3328 444C.tmp 89 PID 4044 wrote to memory of 2252 4044 44C9.tmp 90 PID 4044 wrote to memory of 2252 4044 44C9.tmp 90 PID 4044 wrote to memory of 2252 4044 44C9.tmp 90 PID 2252 wrote to memory of 532 2252 4537.tmp 91 PID 2252 wrote to memory of 532 2252 4537.tmp 91 PID 2252 wrote to memory of 532 2252 4537.tmp 91 PID 532 wrote to memory of 1888 532 4594.tmp 92 PID 532 wrote to memory of 1888 532 4594.tmp 92 PID 532 wrote to memory of 1888 532 4594.tmp 92 PID 1888 wrote to memory of 2628 1888 4602.tmp 93 PID 1888 wrote to memory of 2628 1888 4602.tmp 93 PID 1888 wrote to memory of 2628 1888 4602.tmp 93 PID 2628 wrote to memory of 3892 2628 465F.tmp 94 PID 2628 wrote to memory of 3892 2628 465F.tmp 94 PID 2628 wrote to memory of 3892 2628 465F.tmp 94 PID 3892 wrote to memory of 540 3892 46BD.tmp 95 PID 3892 wrote to memory of 540 3892 46BD.tmp 95 PID 3892 wrote to memory of 540 3892 46BD.tmp 95 PID 540 wrote to memory of 5036 540 470B.tmp 96 PID 540 wrote to memory of 5036 540 470B.tmp 96 PID 540 wrote to memory of 5036 540 470B.tmp 96 PID 5036 wrote to memory of 4936 5036 4779.tmp 97 PID 5036 wrote to memory of 4936 5036 4779.tmp 97 PID 5036 wrote to memory of 4936 5036 4779.tmp 97 PID 4936 wrote to memory of 2768 4936 4805.tmp 98 PID 4936 wrote to memory of 2768 4936 4805.tmp 98 PID 4936 wrote to memory of 2768 4936 4805.tmp 98 PID 2768 wrote to memory of 3524 2768 4853.tmp 99 PID 2768 wrote to memory of 3524 2768 4853.tmp 99 PID 2768 wrote to memory of 3524 2768 4853.tmp 99 PID 3524 wrote to memory of 4496 3524 48C1.tmp 100 PID 3524 wrote to memory of 4496 3524 48C1.tmp 100 PID 3524 wrote to memory of 4496 3524 48C1.tmp 100 PID 4496 wrote to memory of 640 4496 490F.tmp 101 PID 4496 wrote to memory of 640 4496 490F.tmp 101 PID 4496 wrote to memory of 640 4496 490F.tmp 101 PID 640 wrote to memory of 4404 640 497C.tmp 102 PID 640 wrote to memory of 4404 640 497C.tmp 102 PID 640 wrote to memory of 4404 640 497C.tmp 102 PID 4404 wrote to memory of 2188 4404 49DA.tmp 103 PID 4404 wrote to memory of 2188 4404 49DA.tmp 103 PID 4404 wrote to memory of 2188 4404 49DA.tmp 103 PID 2188 wrote to memory of 4500 2188 4A38.tmp 104 PID 2188 wrote to memory of 4500 2188 4A38.tmp 104 PID 2188 wrote to memory of 4500 2188 4A38.tmp 104 PID 4500 wrote to memory of 3460 4500 4AA5.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_8dcc4a041c2d0edfc98cafe271c9ef57_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"23⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"24⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"25⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"26⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"27⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"28⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"29⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"30⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"31⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"32⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"33⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"34⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"35⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"36⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"37⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"38⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"39⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"40⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"41⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"42⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"43⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"44⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"45⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"46⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"47⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"48⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"49⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"50⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"51⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"52⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"53⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"54⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"55⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"56⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"57⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"58⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"59⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"60⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"61⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"62⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"63⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"64⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"65⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"66⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"67⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"68⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"69⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"70⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"71⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"72⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"73⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"74⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"75⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"76⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"77⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"78⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"79⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"80⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"81⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"82⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"83⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"84⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"85⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"86⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"87⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"88⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"89⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"90⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"91⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"92⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"93⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"94⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"95⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"96⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"97⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"98⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"99⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"100⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"101⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"102⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"103⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"104⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"105⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"106⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"107⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"108⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"109⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"110⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"111⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"112⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"113⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"114⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"115⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"116⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"117⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"118⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"119⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"121⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"122⤵PID:3452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-