Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
-
Size
520KB
-
MD5
606f51938e6b1b490ac03007dae689fd
-
SHA1
1ba7deb88344c42b64b15b76a827153575fe5cdd
-
SHA256
caece97f87f778f170aee43c9d50e32de2324ca3f370e822b66d35aa6bbb011a
-
SHA512
3f2a107b9e70cc1b771ecf244f5fb265c29ea57aeaa66e38e190a55870430e885934a861ebcf35bcabbf3ae274a27a043e0fe750c99695620cf4eebd277b2cb0
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLkYevmUToKm1cjNq2FCjgryVD6eyAs9jfpjQ6r:roRXOQjmOyUYevTozl2Ygczyn9D5NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2096 4640.tmp 3164 46FC.tmp 4296 4788.tmp 2552 47F6.tmp 4360 4853.tmp 3552 48F0.tmp 2180 496D.tmp 3432 49EA.tmp 924 4AA5.tmp 1692 4B22.tmp 2652 4B90.tmp 3844 4BFD.tmp 4904 4C6A.tmp 3420 4CC8.tmp 1836 4D84.tmp 3212 4DF1.tmp 3180 4E6E.tmp 4396 4EDB.tmp 676 4F39.tmp 2996 4FC6.tmp 4988 5043.tmp 1720 50EF.tmp 2696 515C.tmp 4920 51E9.tmp 4912 5294.tmp 4936 5311.tmp 4836 536F.tmp 1600 53BD.tmp 4228 543A.tmp 2340 54B7.tmp 2656 5515.tmp 4044 5582.tmp 4600 560F.tmp 2744 565D.tmp 4084 56BB.tmp 1156 5719.tmp 5112 5776.tmp 1484 57D4.tmp 1212 5832.tmp 4332 589F.tmp 1656 58FD.tmp 3480 595B.tmp 1608 59B9.tmp 632 5A16.tmp 1332 5A74.tmp 2360 5AE1.tmp 2116 5B3F.tmp 1052 5B9D.tmp 4136 5BFB.tmp 4428 5C58.tmp 1880 5CB6.tmp 3364 5D14.tmp 856 5D72.tmp 4584 5DCF.tmp 3068 5E2D.tmp 2144 5E8B.tmp 4724 5EE9.tmp 3456 5F46.tmp 4408 5FB4.tmp 4020 6012.tmp 2344 606F.tmp 1132 60CD.tmp 3140 612B.tmp 4204 6198.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4040 wrote to memory of 2096 4040 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 81 PID 4040 wrote to memory of 2096 4040 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 81 PID 4040 wrote to memory of 2096 4040 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 81 PID 2096 wrote to memory of 3164 2096 4640.tmp 82 PID 2096 wrote to memory of 3164 2096 4640.tmp 82 PID 2096 wrote to memory of 3164 2096 4640.tmp 82 PID 3164 wrote to memory of 4296 3164 46FC.tmp 83 PID 3164 wrote to memory of 4296 3164 46FC.tmp 83 PID 3164 wrote to memory of 4296 3164 46FC.tmp 83 PID 4296 wrote to memory of 2552 4296 4788.tmp 84 PID 4296 wrote to memory of 2552 4296 4788.tmp 84 PID 4296 wrote to memory of 2552 4296 4788.tmp 84 PID 2552 wrote to memory of 4360 2552 47F6.tmp 86 PID 2552 wrote to memory of 4360 2552 47F6.tmp 86 PID 2552 wrote to memory of 4360 2552 47F6.tmp 86 PID 4360 wrote to memory of 3552 4360 4853.tmp 88 PID 4360 wrote to memory of 3552 4360 4853.tmp 88 PID 4360 wrote to memory of 3552 4360 4853.tmp 88 PID 3552 wrote to memory of 2180 3552 48F0.tmp 90 PID 3552 wrote to memory of 2180 3552 48F0.tmp 90 PID 3552 wrote to memory of 2180 3552 48F0.tmp 90 PID 2180 wrote to memory of 3432 2180 496D.tmp 91 PID 2180 wrote to memory of 3432 2180 496D.tmp 91 PID 2180 wrote to memory of 3432 2180 496D.tmp 91 PID 3432 wrote to memory of 924 3432 49EA.tmp 92 PID 3432 wrote to memory of 924 3432 49EA.tmp 92 PID 3432 wrote to memory of 924 3432 49EA.tmp 92 PID 924 wrote to memory of 1692 924 4AA5.tmp 93 PID 924 wrote to memory of 1692 924 4AA5.tmp 93 PID 924 wrote to memory of 1692 924 4AA5.tmp 93 PID 1692 wrote to memory of 2652 1692 4B22.tmp 94 PID 1692 wrote to memory of 2652 1692 4B22.tmp 94 PID 1692 wrote to memory of 2652 1692 4B22.tmp 94 PID 2652 wrote to memory of 3844 2652 4B90.tmp 95 PID 2652 wrote to memory of 3844 2652 4B90.tmp 95 PID 2652 wrote to memory of 3844 2652 4B90.tmp 95 PID 3844 wrote to memory of 4904 3844 4BFD.tmp 96 PID 3844 wrote to memory of 4904 3844 4BFD.tmp 96 PID 3844 wrote to memory of 4904 3844 4BFD.tmp 96 PID 4904 wrote to memory of 3420 4904 4C6A.tmp 97 PID 4904 wrote to memory of 3420 4904 4C6A.tmp 97 PID 4904 wrote to memory of 3420 4904 4C6A.tmp 97 PID 3420 wrote to memory of 1836 3420 4CC8.tmp 98 PID 3420 wrote to memory of 1836 3420 4CC8.tmp 98 PID 3420 wrote to memory of 1836 3420 4CC8.tmp 98 PID 1836 wrote to memory of 3212 1836 4D84.tmp 99 PID 1836 wrote to memory of 3212 1836 4D84.tmp 99 PID 1836 wrote to memory of 3212 1836 4D84.tmp 99 PID 3212 wrote to memory of 3180 3212 4DF1.tmp 100 PID 3212 wrote to memory of 3180 3212 4DF1.tmp 100 PID 3212 wrote to memory of 3180 3212 4DF1.tmp 100 PID 3180 wrote to memory of 4396 3180 4E6E.tmp 101 PID 3180 wrote to memory of 4396 3180 4E6E.tmp 101 PID 3180 wrote to memory of 4396 3180 4E6E.tmp 101 PID 4396 wrote to memory of 676 4396 4EDB.tmp 102 PID 4396 wrote to memory of 676 4396 4EDB.tmp 102 PID 4396 wrote to memory of 676 4396 4EDB.tmp 102 PID 676 wrote to memory of 2996 676 4F39.tmp 103 PID 676 wrote to memory of 2996 676 4F39.tmp 103 PID 676 wrote to memory of 2996 676 4F39.tmp 103 PID 2996 wrote to memory of 4988 2996 4FC6.tmp 104 PID 2996 wrote to memory of 4988 2996 4FC6.tmp 104 PID 2996 wrote to memory of 4988 2996 4FC6.tmp 104 PID 4988 wrote to memory of 1720 4988 5043.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"23⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"24⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"25⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"26⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"27⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"28⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"29⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"30⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"31⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"32⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"33⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"34⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"35⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"36⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"37⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"38⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"39⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"40⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"41⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"42⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"43⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"44⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"45⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"46⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"47⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"48⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"49⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"50⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"51⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"52⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"53⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"54⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"55⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"56⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"57⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"58⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"59⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"60⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"61⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"62⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"63⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"64⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"65⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"66⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"67⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"68⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"69⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"70⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"71⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"72⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"73⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"74⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"75⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"76⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"77⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"78⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"79⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"80⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"81⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"82⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"83⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"84⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"85⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"86⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"87⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"88⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"89⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"90⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"91⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"92⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"93⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"94⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"95⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"96⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"97⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"98⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"99⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"100⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"101⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"102⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"103⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"104⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"105⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"106⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"107⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"108⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"109⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"110⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"111⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"112⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"113⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"114⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"115⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"116⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"117⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"118⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"119⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"120⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"121⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"122⤵PID:3024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-