Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe
-
Size
536KB
-
MD5
09d1eb893a375367c3230598281e69d3
-
SHA1
5a731c2aa6829a6b1de22814bd4e98d8501bbb62
-
SHA256
f9e9b3c9e6c20acf2e2d10398acf5a4135968739112555d8f5302022a01037f0
-
SHA512
95ae2abc06aa2c07f08e2a4a3e2a0d39b25d12c7b73384b2292cf8bb6611e1ade863b703b5f35718df64538c981cca4fb2b6c4efd94531ecdf9c757d1017359f
-
SSDEEP
12288:wU5rCOTeiUkswcUugXgSxM+ptVBl4kYYB0TsIZxVJ0ZT9:wUQOJU3tagSxMorH4kYYIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4536 5EAA.tmp 1316 5F95.tmp 4544 6050.tmp 3424 613A.tmp 1140 61F6.tmp 3616 62D1.tmp 228 63CB.tmp 808 6486.tmp 188 6551.tmp 4664 663C.tmp 776 66F7.tmp 4640 67E2.tmp 2004 689D.tmp 4872 6978.tmp 3372 6A24.tmp 1620 6AC0.tmp 1600 6B5C.tmp 2136 6C27.tmp 2596 6CD3.tmp 636 6D6F.tmp 4500 6E0C.tmp 2228 6EA8.tmp 4764 6F54.tmp 4980 700F.tmp 2232 70EA.tmp 3980 7203.tmp 1508 72AF.tmp 1664 738A.tmp 4292 7445.tmp 664 7511.tmp 1768 75BC.tmp 2736 7678.tmp 5080 7724.tmp 396 77C0.tmp 2060 782D.tmp 1504 78BA.tmp 1988 7947.tmp 3556 79B4.tmp 5012 7A21.tmp 1548 7ABE.tmp 228 7B1B.tmp 3264 7B98.tmp 4740 7C15.tmp 3260 7CA2.tmp 764 7CF0.tmp 564 7D7D.tmp 4936 7DFA.tmp 216 7E67.tmp 668 7F03.tmp 2236 7F52.tmp 2984 7FAF.tmp 4360 801D.tmp 3108 806B.tmp 1836 80B9.tmp 3376 8117.tmp 4920 8174.tmp 3492 81D2.tmp 3028 8240.tmp 4396 829D.tmp 368 82FB.tmp 3996 8349.tmp 4500 83A7.tmp 2600 83F5.tmp 4412 8443.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 4536 2248 2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe 83 PID 2248 wrote to memory of 4536 2248 2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe 83 PID 2248 wrote to memory of 4536 2248 2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe 83 PID 4536 wrote to memory of 1316 4536 5EAA.tmp 84 PID 4536 wrote to memory of 1316 4536 5EAA.tmp 84 PID 4536 wrote to memory of 1316 4536 5EAA.tmp 84 PID 1316 wrote to memory of 4544 1316 5F95.tmp 86 PID 1316 wrote to memory of 4544 1316 5F95.tmp 86 PID 1316 wrote to memory of 4544 1316 5F95.tmp 86 PID 4544 wrote to memory of 3424 4544 6050.tmp 88 PID 4544 wrote to memory of 3424 4544 6050.tmp 88 PID 4544 wrote to memory of 3424 4544 6050.tmp 88 PID 3424 wrote to memory of 1140 3424 613A.tmp 89 PID 3424 wrote to memory of 1140 3424 613A.tmp 89 PID 3424 wrote to memory of 1140 3424 613A.tmp 89 PID 1140 wrote to memory of 3616 1140 61F6.tmp 91 PID 1140 wrote to memory of 3616 1140 61F6.tmp 91 PID 1140 wrote to memory of 3616 1140 61F6.tmp 91 PID 3616 wrote to memory of 228 3616 62D1.tmp 92 PID 3616 wrote to memory of 228 3616 62D1.tmp 92 PID 3616 wrote to memory of 228 3616 62D1.tmp 92 PID 228 wrote to memory of 808 228 63CB.tmp 93 PID 228 wrote to memory of 808 228 63CB.tmp 93 PID 228 wrote to memory of 808 228 63CB.tmp 93 PID 808 wrote to memory of 188 808 6486.tmp 95 PID 808 wrote to memory of 188 808 6486.tmp 95 PID 808 wrote to memory of 188 808 6486.tmp 95 PID 188 wrote to memory of 4664 188 6551.tmp 96 PID 188 wrote to memory of 4664 188 6551.tmp 96 PID 188 wrote to memory of 4664 188 6551.tmp 96 PID 4664 wrote to memory of 776 4664 663C.tmp 97 PID 4664 wrote to memory of 776 4664 663C.tmp 97 PID 4664 wrote to memory of 776 4664 663C.tmp 97 PID 776 wrote to memory of 4640 776 66F7.tmp 98 PID 776 wrote to memory of 4640 776 66F7.tmp 98 PID 776 wrote to memory of 4640 776 66F7.tmp 98 PID 4640 wrote to memory of 2004 4640 67E2.tmp 99 PID 4640 wrote to memory of 2004 4640 67E2.tmp 99 PID 4640 wrote to memory of 2004 4640 67E2.tmp 99 PID 2004 wrote to memory of 4872 2004 689D.tmp 100 PID 2004 wrote to memory of 4872 2004 689D.tmp 100 PID 2004 wrote to memory of 4872 2004 689D.tmp 100 PID 4872 wrote to memory of 3372 4872 6978.tmp 101 PID 4872 wrote to memory of 3372 4872 6978.tmp 101 PID 4872 wrote to memory of 3372 4872 6978.tmp 101 PID 3372 wrote to memory of 1620 3372 6A24.tmp 102 PID 3372 wrote to memory of 1620 3372 6A24.tmp 102 PID 3372 wrote to memory of 1620 3372 6A24.tmp 102 PID 1620 wrote to memory of 1600 1620 6AC0.tmp 103 PID 1620 wrote to memory of 1600 1620 6AC0.tmp 103 PID 1620 wrote to memory of 1600 1620 6AC0.tmp 103 PID 1600 wrote to memory of 2136 1600 6B5C.tmp 104 PID 1600 wrote to memory of 2136 1600 6B5C.tmp 104 PID 1600 wrote to memory of 2136 1600 6B5C.tmp 104 PID 2136 wrote to memory of 2596 2136 6C27.tmp 105 PID 2136 wrote to memory of 2596 2136 6C27.tmp 105 PID 2136 wrote to memory of 2596 2136 6C27.tmp 105 PID 2596 wrote to memory of 636 2596 6CD3.tmp 106 PID 2596 wrote to memory of 636 2596 6CD3.tmp 106 PID 2596 wrote to memory of 636 2596 6CD3.tmp 106 PID 636 wrote to memory of 4500 636 6D6F.tmp 107 PID 636 wrote to memory of 4500 636 6D6F.tmp 107 PID 636 wrote to memory of 4500 636 6D6F.tmp 107 PID 4500 wrote to memory of 2228 4500 6E0C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_09d1eb893a375367c3230598281e69d3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"23⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"24⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"25⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"26⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"27⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"28⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"29⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"30⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"31⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"32⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"33⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"34⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"35⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"36⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"37⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"38⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"39⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"40⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"41⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"42⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"43⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"44⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"45⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"46⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"47⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"48⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"49⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"50⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"51⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"52⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"53⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"54⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"55⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"56⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"57⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"58⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"59⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"60⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"61⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"62⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"63⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"64⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"65⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"66⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"67⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"68⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"69⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"70⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"72⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"73⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"74⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"75⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"76⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"77⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"78⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"79⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"80⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"81⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"82⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"83⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"84⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"85⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"86⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"87⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"88⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"89⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"90⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"91⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"92⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"93⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"94⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"95⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"96⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"97⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"98⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"99⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"100⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"101⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"102⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"103⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"104⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"106⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"107⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"108⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"109⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"110⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"111⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"112⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"113⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"114⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"115⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"116⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"117⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"118⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"119⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"120⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"121⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"122⤵PID:3456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-