Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 11:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe
-
Size
487KB
-
MD5
89f2d01ab077caf49d605fdebbef3a4e
-
SHA1
fb79ae0733f7317078da611f7d49ee762545082b
-
SHA256
7b1de608d0a9702071dbe5a9f02899ba95e59e25a1bf25d197e854986365f264
-
SHA512
8c3b569aa21f1e51831fd96b79e67b1c774cc0faa171ebba33b698e6affa76fbef04005a8ab001a0109d788e4e7c6bfaa25d58f129c7efa002f635e0849a5b2a
-
SSDEEP
12288:HU5rCOTeiJbiHJqq1z8fb00+Zu6FJWTEG0djiQdM8NZ:HUQOJJ2Hw00+INZQdM8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4428 467F.tmp 4372 46EC.tmp 740 473A.tmp 3960 4788.tmp 60 4805.tmp 4204 4853.tmp 1304 48A2.tmp 1636 48F0.tmp 4508 493E.tmp 508 498C.tmp 4520 49DA.tmp 3700 4A28.tmp 4380 4A76.tmp 1352 4AC4.tmp 1260 4B22.tmp 2884 4B70.tmp 3520 4BDE.tmp 3236 4C2C.tmp 1764 4C7A.tmp 1584 4CC8.tmp 5076 4D16.tmp 2204 4D64.tmp 2068 4DB2.tmp 3380 4E01.tmp 3240 4E4F.tmp 4592 4EAC.tmp 4292 4EFB.tmp 4496 4F68.tmp 2372 4FC6.tmp 4008 5023.tmp 1016 5091.tmp 3684 50EF.tmp 2564 513D.tmp 1196 518B.tmp 1648 51D9.tmp 3152 5227.tmp 1236 5275.tmp 1808 52C3.tmp 4956 5311.tmp 1980 5360.tmp 1004 53AE.tmp 2028 540B.tmp 2320 545A.tmp 4264 54A8.tmp 1436 54F6.tmp 3300 5544.tmp 3224 5592.tmp 4396 55E0.tmp 4588 562E.tmp 4488 567C.tmp 4016 56BB.tmp 2680 5709.tmp 4120 5748.tmp 4044 5796.tmp 1064 57E4.tmp 2404 5832.tmp 3660 5880.tmp 3716 58CE.tmp 3484 591C.tmp 2296 596A.tmp 2928 59B9.tmp 1048 5A07.tmp 2476 5A55.tmp 632 5AA3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4428 3092 2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe 81 PID 3092 wrote to memory of 4428 3092 2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe 81 PID 3092 wrote to memory of 4428 3092 2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe 81 PID 4428 wrote to memory of 4372 4428 467F.tmp 82 PID 4428 wrote to memory of 4372 4428 467F.tmp 82 PID 4428 wrote to memory of 4372 4428 467F.tmp 82 PID 4372 wrote to memory of 740 4372 46EC.tmp 83 PID 4372 wrote to memory of 740 4372 46EC.tmp 83 PID 4372 wrote to memory of 740 4372 46EC.tmp 83 PID 740 wrote to memory of 3960 740 473A.tmp 84 PID 740 wrote to memory of 3960 740 473A.tmp 84 PID 740 wrote to memory of 3960 740 473A.tmp 84 PID 3960 wrote to memory of 60 3960 4788.tmp 85 PID 3960 wrote to memory of 60 3960 4788.tmp 85 PID 3960 wrote to memory of 60 3960 4788.tmp 85 PID 60 wrote to memory of 4204 60 4805.tmp 86 PID 60 wrote to memory of 4204 60 4805.tmp 86 PID 60 wrote to memory of 4204 60 4805.tmp 86 PID 4204 wrote to memory of 1304 4204 4853.tmp 87 PID 4204 wrote to memory of 1304 4204 4853.tmp 87 PID 4204 wrote to memory of 1304 4204 4853.tmp 87 PID 1304 wrote to memory of 1636 1304 48A2.tmp 88 PID 1304 wrote to memory of 1636 1304 48A2.tmp 88 PID 1304 wrote to memory of 1636 1304 48A2.tmp 88 PID 1636 wrote to memory of 4508 1636 48F0.tmp 89 PID 1636 wrote to memory of 4508 1636 48F0.tmp 89 PID 1636 wrote to memory of 4508 1636 48F0.tmp 89 PID 4508 wrote to memory of 508 4508 493E.tmp 90 PID 4508 wrote to memory of 508 4508 493E.tmp 90 PID 4508 wrote to memory of 508 4508 493E.tmp 90 PID 508 wrote to memory of 4520 508 498C.tmp 91 PID 508 wrote to memory of 4520 508 498C.tmp 91 PID 508 wrote to memory of 4520 508 498C.tmp 91 PID 4520 wrote to memory of 3700 4520 49DA.tmp 92 PID 4520 wrote to memory of 3700 4520 49DA.tmp 92 PID 4520 wrote to memory of 3700 4520 49DA.tmp 92 PID 3700 wrote to memory of 4380 3700 4A28.tmp 93 PID 3700 wrote to memory of 4380 3700 4A28.tmp 93 PID 3700 wrote to memory of 4380 3700 4A28.tmp 93 PID 4380 wrote to memory of 1352 4380 4A76.tmp 94 PID 4380 wrote to memory of 1352 4380 4A76.tmp 94 PID 4380 wrote to memory of 1352 4380 4A76.tmp 94 PID 1352 wrote to memory of 1260 1352 4AC4.tmp 95 PID 1352 wrote to memory of 1260 1352 4AC4.tmp 95 PID 1352 wrote to memory of 1260 1352 4AC4.tmp 95 PID 1260 wrote to memory of 2884 1260 4B22.tmp 96 PID 1260 wrote to memory of 2884 1260 4B22.tmp 96 PID 1260 wrote to memory of 2884 1260 4B22.tmp 96 PID 2884 wrote to memory of 3520 2884 4B70.tmp 97 PID 2884 wrote to memory of 3520 2884 4B70.tmp 97 PID 2884 wrote to memory of 3520 2884 4B70.tmp 97 PID 3520 wrote to memory of 3236 3520 4BDE.tmp 98 PID 3520 wrote to memory of 3236 3520 4BDE.tmp 98 PID 3520 wrote to memory of 3236 3520 4BDE.tmp 98 PID 3236 wrote to memory of 1764 3236 4C2C.tmp 99 PID 3236 wrote to memory of 1764 3236 4C2C.tmp 99 PID 3236 wrote to memory of 1764 3236 4C2C.tmp 99 PID 1764 wrote to memory of 1584 1764 4C7A.tmp 100 PID 1764 wrote to memory of 1584 1764 4C7A.tmp 100 PID 1764 wrote to memory of 1584 1764 4C7A.tmp 100 PID 1584 wrote to memory of 5076 1584 4CC8.tmp 101 PID 1584 wrote to memory of 5076 1584 4CC8.tmp 101 PID 1584 wrote to memory of 5076 1584 4CC8.tmp 101 PID 5076 wrote to memory of 2204 5076 4D16.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_89f2d01ab077caf49d605fdebbef3a4e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"23⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"24⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"25⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"26⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"27⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"28⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"29⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"30⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"31⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"32⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"33⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"34⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"35⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"36⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"37⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"38⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"39⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"40⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"41⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"42⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"43⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"44⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"45⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"46⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"47⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"48⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"49⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"50⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"51⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"52⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"53⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"54⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"55⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"56⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"57⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"58⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"59⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"60⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"61⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"62⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"63⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"64⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"65⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"66⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"67⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"68⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"69⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"70⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"71⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"72⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"73⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"74⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"75⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"76⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"77⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"78⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"79⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"80⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"81⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"82⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"83⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"84⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"85⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"86⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"87⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"88⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"89⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"90⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"91⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"92⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"93⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"94⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"95⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"96⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"97⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"98⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"99⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"100⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"101⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"102⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"103⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"104⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"105⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"106⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"107⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"108⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"109⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"110⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"111⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"112⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"113⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"114⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"115⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"116⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"117⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"118⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"119⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"120⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"121⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-