Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
-
Size
487KB
-
MD5
f7dce14e4ed0f3d99fd45a1e8ebe3734
-
SHA1
1235c41910d97e05d0c835ceb502ef6d8da096fa
-
SHA256
81c55feb0363fae7233dff7877e99b447daba57eb7e14dd284e8746da1eb1a71
-
SHA512
1a94464b2c854b1bedec5c10af2ecfd134fd95d2e4ede38b5b67f5054ddc4c6f27bbb8452cdde9140675556f4a062275ac88c288295eb03a9ba39f8f3421651f
-
SSDEEP
12288:yU5rCOTeiNQ8dgBV8Jn2Pdjk6ZSeVbqnbZ:yUQOJNLdNJn2PqYSWbqnb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3148 45D3.tmp 4752 466F.tmp 4400 471B.tmp 2632 47D6.tmp 2856 4853.tmp 1992 48C1.tmp 4144 492E.tmp 4980 499C.tmp 4688 4A19.tmp 1236 4A96.tmp 532 4B22.tmp 2400 4B80.tmp 2624 4C0D.tmp 4792 4C8A.tmp 2424 4D35.tmp 4300 4DA3.tmp 1528 4E3F.tmp 4476 4EDB.tmp 1880 4F39.tmp 4564 4FA6.tmp 2180 5014.tmp 4420 50B0.tmp 3360 511D.tmp 4868 518B.tmp 5012 51F8.tmp 740 5246.tmp 1996 52C3.tmp 3240 5350.tmp 1852 53BD.tmp 2896 5469.tmp 4928 54D7.tmp 1448 5573.tmp 4140 560F.tmp 4344 565D.tmp 4360 56CB.tmp 1036 5738.tmp 1884 5796.tmp 640 5803.tmp 1120 5870.tmp 372 58CE.tmp 864 591C.tmp 3716 598A.tmp 1776 59E7.tmp 4400 5A45.tmp 4408 5AA3.tmp 2280 5B01.tmp 2856 5B5E.tmp 4464 5BBC.tmp 4052 5C2A.tmp 5088 5C97.tmp 2836 5CF5.tmp 2356 5D62.tmp 3876 5DC0.tmp 2420 5E2D.tmp 4628 5E9B.tmp 1056 5F08.tmp 5096 5F75.tmp 2952 5FE3.tmp 3224 6050.tmp 2660 60AE.tmp 1772 60FC.tmp 1872 6169.tmp 1564 61D7.tmp 1528 6244.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 3148 2772 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 86 PID 2772 wrote to memory of 3148 2772 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 86 PID 2772 wrote to memory of 3148 2772 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 86 PID 3148 wrote to memory of 4752 3148 45D3.tmp 88 PID 3148 wrote to memory of 4752 3148 45D3.tmp 88 PID 3148 wrote to memory of 4752 3148 45D3.tmp 88 PID 4752 wrote to memory of 4400 4752 466F.tmp 89 PID 4752 wrote to memory of 4400 4752 466F.tmp 89 PID 4752 wrote to memory of 4400 4752 466F.tmp 89 PID 4400 wrote to memory of 2632 4400 471B.tmp 92 PID 4400 wrote to memory of 2632 4400 471B.tmp 92 PID 4400 wrote to memory of 2632 4400 471B.tmp 92 PID 2632 wrote to memory of 2856 2632 47D6.tmp 93 PID 2632 wrote to memory of 2856 2632 47D6.tmp 93 PID 2632 wrote to memory of 2856 2632 47D6.tmp 93 PID 2856 wrote to memory of 1992 2856 4853.tmp 94 PID 2856 wrote to memory of 1992 2856 4853.tmp 94 PID 2856 wrote to memory of 1992 2856 4853.tmp 94 PID 1992 wrote to memory of 4144 1992 48C1.tmp 95 PID 1992 wrote to memory of 4144 1992 48C1.tmp 95 PID 1992 wrote to memory of 4144 1992 48C1.tmp 95 PID 4144 wrote to memory of 4980 4144 492E.tmp 96 PID 4144 wrote to memory of 4980 4144 492E.tmp 96 PID 4144 wrote to memory of 4980 4144 492E.tmp 96 PID 4980 wrote to memory of 4688 4980 499C.tmp 97 PID 4980 wrote to memory of 4688 4980 499C.tmp 97 PID 4980 wrote to memory of 4688 4980 499C.tmp 97 PID 4688 wrote to memory of 1236 4688 4A19.tmp 98 PID 4688 wrote to memory of 1236 4688 4A19.tmp 98 PID 4688 wrote to memory of 1236 4688 4A19.tmp 98 PID 1236 wrote to memory of 532 1236 4A96.tmp 99 PID 1236 wrote to memory of 532 1236 4A96.tmp 99 PID 1236 wrote to memory of 532 1236 4A96.tmp 99 PID 532 wrote to memory of 2400 532 4B22.tmp 100 PID 532 wrote to memory of 2400 532 4B22.tmp 100 PID 532 wrote to memory of 2400 532 4B22.tmp 100 PID 2400 wrote to memory of 2624 2400 4B80.tmp 101 PID 2400 wrote to memory of 2624 2400 4B80.tmp 101 PID 2400 wrote to memory of 2624 2400 4B80.tmp 101 PID 2624 wrote to memory of 4792 2624 4C0D.tmp 102 PID 2624 wrote to memory of 4792 2624 4C0D.tmp 102 PID 2624 wrote to memory of 4792 2624 4C0D.tmp 102 PID 4792 wrote to memory of 2424 4792 4C8A.tmp 103 PID 4792 wrote to memory of 2424 4792 4C8A.tmp 103 PID 4792 wrote to memory of 2424 4792 4C8A.tmp 103 PID 2424 wrote to memory of 4300 2424 4D35.tmp 104 PID 2424 wrote to memory of 4300 2424 4D35.tmp 104 PID 2424 wrote to memory of 4300 2424 4D35.tmp 104 PID 4300 wrote to memory of 1528 4300 4DA3.tmp 105 PID 4300 wrote to memory of 1528 4300 4DA3.tmp 105 PID 4300 wrote to memory of 1528 4300 4DA3.tmp 105 PID 1528 wrote to memory of 4476 1528 4E3F.tmp 106 PID 1528 wrote to memory of 4476 1528 4E3F.tmp 106 PID 1528 wrote to memory of 4476 1528 4E3F.tmp 106 PID 4476 wrote to memory of 1880 4476 4EDB.tmp 107 PID 4476 wrote to memory of 1880 4476 4EDB.tmp 107 PID 4476 wrote to memory of 1880 4476 4EDB.tmp 107 PID 1880 wrote to memory of 4564 1880 4F39.tmp 108 PID 1880 wrote to memory of 4564 1880 4F39.tmp 108 PID 1880 wrote to memory of 4564 1880 4F39.tmp 108 PID 4564 wrote to memory of 2180 4564 4FA6.tmp 109 PID 4564 wrote to memory of 2180 4564 4FA6.tmp 109 PID 4564 wrote to memory of 2180 4564 4FA6.tmp 109 PID 2180 wrote to memory of 4420 2180 5014.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"23⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"24⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"25⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"26⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"27⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"28⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"29⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"30⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"31⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"32⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"33⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"34⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"35⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"36⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"37⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"38⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"39⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"40⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"41⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"42⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"43⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"44⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"45⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"46⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"47⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"48⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"49⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"50⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"51⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"52⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"53⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"54⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"55⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"56⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"57⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"58⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"59⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"60⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"61⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"62⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"63⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"64⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"65⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"66⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"67⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"68⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"69⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"70⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"71⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"72⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"73⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"74⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"75⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"76⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"77⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"78⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"79⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"81⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"82⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"83⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"84⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"85⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"86⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"87⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"89⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"90⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"91⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"92⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"93⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"94⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"95⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"96⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"97⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"98⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"99⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"100⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"101⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"102⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"103⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"104⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"105⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"106⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"107⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"108⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"109⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"110⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"111⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"112⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"113⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"114⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"115⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"116⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"117⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"118⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"119⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"121⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-