Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 10:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe
-
Size
529KB
-
MD5
f9a9f27e78dab0c6ef87107bcbdb53f7
-
SHA1
63aba62dce6a518680f52fb1492bd783278bcd47
-
SHA256
3ddc0af010e1cda1dfd11c4048f2e426f7d8f29caa663d742f6b58722e532f35
-
SHA512
49322c82e1eb1e00b448cffdd574917a6379caae1ea76a8b0eb63536171bad4e4bfdddc7dc40655c29f995582539a5276629b0dd7f76d65218d8d332fb011f5a
-
SSDEEP
12288:NU5rCOTeijL5l8IiC3I+zxgT3DCjNtluWYEnTZwlH4Hp:NUQOJjFl8BC4CxgrOjNCWYEnTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1676 421A.tmp 1004 4287.tmp 880 4304.tmp 1620 4371.tmp 3944 43DF.tmp 3612 442D.tmp 2580 448B.tmp 1436 44D9.tmp 4392 4527.tmp 2196 4575.tmp 4444 45C3.tmp 3680 4611.tmp 1036 465F.tmp 1316 46AE.tmp 468 46FC.tmp 4464 474A.tmp 3100 4798.tmp 2612 47E6.tmp 2128 4844.tmp 1912 4892.tmp 4580 48FF.tmp 1688 496D.tmp 2948 49CA.tmp 1228 4A28.tmp 1116 4A76.tmp 3120 4AC4.tmp 3532 4B13.tmp 516 4B61.tmp 2096 4BBE.tmp 2736 4C1C.tmp 2500 4C6A.tmp 2812 4CB8.tmp 752 4D45.tmp 4760 4D93.tmp 3416 4DE1.tmp 4544 4E2F.tmp 1484 4E7E.tmp 2300 4EBC.tmp 400 4EFB.tmp 1308 4F49.tmp 1744 4F87.tmp 1572 4FC6.tmp 4988 5004.tmp 4260 5072.tmp 3992 50DF.tmp 3360 514C.tmp 2544 51E9.tmp 3400 5275.tmp 1120 52D3.tmp 2392 5331.tmp 440 53CD.tmp 3392 542B.tmp 1132 5479.tmp 4880 54F6.tmp 396 5592.tmp 3264 55F0.tmp 968 564E.tmp 2404 569C.tmp 4784 56EA.tmp 3148 5738.tmp 2980 5786.tmp 2760 57D4.tmp 4080 5822.tmp 4352 5880.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1676 2920 2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe 81 PID 2920 wrote to memory of 1676 2920 2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe 81 PID 2920 wrote to memory of 1676 2920 2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe 81 PID 1676 wrote to memory of 1004 1676 421A.tmp 82 PID 1676 wrote to memory of 1004 1676 421A.tmp 82 PID 1676 wrote to memory of 1004 1676 421A.tmp 82 PID 1004 wrote to memory of 880 1004 4287.tmp 83 PID 1004 wrote to memory of 880 1004 4287.tmp 83 PID 1004 wrote to memory of 880 1004 4287.tmp 83 PID 880 wrote to memory of 1620 880 4304.tmp 84 PID 880 wrote to memory of 1620 880 4304.tmp 84 PID 880 wrote to memory of 1620 880 4304.tmp 84 PID 1620 wrote to memory of 3944 1620 4371.tmp 85 PID 1620 wrote to memory of 3944 1620 4371.tmp 85 PID 1620 wrote to memory of 3944 1620 4371.tmp 85 PID 3944 wrote to memory of 3612 3944 43DF.tmp 86 PID 3944 wrote to memory of 3612 3944 43DF.tmp 86 PID 3944 wrote to memory of 3612 3944 43DF.tmp 86 PID 3612 wrote to memory of 2580 3612 442D.tmp 87 PID 3612 wrote to memory of 2580 3612 442D.tmp 87 PID 3612 wrote to memory of 2580 3612 442D.tmp 87 PID 2580 wrote to memory of 1436 2580 448B.tmp 88 PID 2580 wrote to memory of 1436 2580 448B.tmp 88 PID 2580 wrote to memory of 1436 2580 448B.tmp 88 PID 1436 wrote to memory of 4392 1436 44D9.tmp 89 PID 1436 wrote to memory of 4392 1436 44D9.tmp 89 PID 1436 wrote to memory of 4392 1436 44D9.tmp 89 PID 4392 wrote to memory of 2196 4392 4527.tmp 90 PID 4392 wrote to memory of 2196 4392 4527.tmp 90 PID 4392 wrote to memory of 2196 4392 4527.tmp 90 PID 2196 wrote to memory of 4444 2196 4575.tmp 91 PID 2196 wrote to memory of 4444 2196 4575.tmp 91 PID 2196 wrote to memory of 4444 2196 4575.tmp 91 PID 4444 wrote to memory of 3680 4444 45C3.tmp 92 PID 4444 wrote to memory of 3680 4444 45C3.tmp 92 PID 4444 wrote to memory of 3680 4444 45C3.tmp 92 PID 3680 wrote to memory of 1036 3680 4611.tmp 93 PID 3680 wrote to memory of 1036 3680 4611.tmp 93 PID 3680 wrote to memory of 1036 3680 4611.tmp 93 PID 1036 wrote to memory of 1316 1036 465F.tmp 94 PID 1036 wrote to memory of 1316 1036 465F.tmp 94 PID 1036 wrote to memory of 1316 1036 465F.tmp 94 PID 1316 wrote to memory of 468 1316 46AE.tmp 95 PID 1316 wrote to memory of 468 1316 46AE.tmp 95 PID 1316 wrote to memory of 468 1316 46AE.tmp 95 PID 468 wrote to memory of 4464 468 46FC.tmp 96 PID 468 wrote to memory of 4464 468 46FC.tmp 96 PID 468 wrote to memory of 4464 468 46FC.tmp 96 PID 4464 wrote to memory of 3100 4464 474A.tmp 97 PID 4464 wrote to memory of 3100 4464 474A.tmp 97 PID 4464 wrote to memory of 3100 4464 474A.tmp 97 PID 3100 wrote to memory of 2612 3100 4798.tmp 98 PID 3100 wrote to memory of 2612 3100 4798.tmp 98 PID 3100 wrote to memory of 2612 3100 4798.tmp 98 PID 2612 wrote to memory of 2128 2612 47E6.tmp 99 PID 2612 wrote to memory of 2128 2612 47E6.tmp 99 PID 2612 wrote to memory of 2128 2612 47E6.tmp 99 PID 2128 wrote to memory of 1912 2128 4844.tmp 100 PID 2128 wrote to memory of 1912 2128 4844.tmp 100 PID 2128 wrote to memory of 1912 2128 4844.tmp 100 PID 1912 wrote to memory of 4580 1912 4892.tmp 101 PID 1912 wrote to memory of 4580 1912 4892.tmp 101 PID 1912 wrote to memory of 4580 1912 4892.tmp 101 PID 4580 wrote to memory of 1688 4580 48FF.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-27_f9a9f27e78dab0c6ef87107bcbdb53f7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"23⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"24⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"25⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"26⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"27⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"28⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"29⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"30⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"31⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"32⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"33⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"34⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"35⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"36⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"37⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"38⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"39⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"40⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"41⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"42⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"43⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"44⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"45⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"46⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"47⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"48⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"49⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"50⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"51⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"52⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"53⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"54⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"55⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"56⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"57⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"58⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"59⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"60⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"61⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"62⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"63⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"64⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"65⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"66⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"67⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"68⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"69⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"70⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"71⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"72⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"73⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"74⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"75⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"76⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"77⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"78⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"79⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"80⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"81⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"83⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"84⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"85⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"86⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"87⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"88⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"89⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"90⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"91⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"92⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"94⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"95⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"96⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"97⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"98⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"99⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"100⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"101⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"102⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"103⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"104⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"105⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"106⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"107⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"108⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"109⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"110⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"111⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"112⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"113⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"114⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"115⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"116⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"117⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"118⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"119⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"120⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"121⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"122⤵PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-