Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
- Target 2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe
- Size 520KB
- Sample240613-b3m8aazbrd
- SHA256 9f9d1bd0b697f63d8d0605d4d1c63337210042455c912096c22b050f0f6a29cc
- MD5 a9f2505f7fde42b290f331d183c060af
- SHA1 0ca2b79296d9117fb5532475e87b1e9527b9601d
- SHA512 299cda4fc81237ac522db3a822c6e8b4524d663d16e1f7258a6e2d4f89a259c237b3d3fba7a9e3f6d58c7fa9fe49573bee2a8e39ebd1ed6c832b85be58509d77
- SSDEEP 12288:gj8fuxR21t5i8fOzKuM9WHE9VkzQjtgUONZ:gj8fuK1GYOzwAE92cBxON
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 216 4C7A.tmp 4508 4D16.tmp 4180 4D74.tmp 4848 4E3F.tmp 2696 4EBC.tmp 988 4F49.tmp 1752 4FC6.tmp 5048 5072.tmp 2196 510E.tmp 4308 51AA.tmp 5092 5217.tmp 4016 5285.tmp 3668 52F2.tmp 5044 537F.tmp 1224 53FC.tmp 4576 5469.tmp 2568 5505.tmp 4436 5573.tmp 548 55E0.tmp 3248 565D.tmp 3188 56CB.tmp 4596 5757.tmp 3496 57F3.tmp 1516 5861.tmp 4444 58BF.tmp 3468 592C.tmp 4780 59A9.tmp 2032 5A26.tmp 3972 5A93.tmp 4960 5B01.tmp 4484 5B8D.tmp 3632 5C2A.tmp 3036 5CA7.tmp 2872 5D04.tmp 3768 5D52.tmp 1036 5DB0.tmp 3596 5E1E.tmp 2304 5E7B.tmp 2616 5ED9.tmp 3360 5F37.tmp 4736 5FA4.tmp 1356 6002.tmp 2620 6050.tmp 4888 60AE.tmp 4440 611B.tmp 2080 6169.tmp 4468 61C7.tmp 3452 6215.tmp 388 6263.tmp 704 62B1.tmp 700 630F.tmp 4012 636D.tmp 3220 63BB.tmp 4048 6419.tmp 1240 6477.tmp 1200 64C5.tmp 2000 6522.tmp 4792 6571.tmp 2696 65DE.tmp 900 662C.tmp 988 668A.tmp 4228 66E8.tmp 3764 6745.tmp 1316 6793.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 216 1568 2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe 83 PID 1568 wrote to memory of 216 1568 2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe 83 PID 1568 wrote to memory of 216 1568 2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe 83 PID 216 wrote to memory of 4508 216 4C7A.tmp 85 PID 216 wrote to memory of 4508 216 4C7A.tmp 85 PID 216 wrote to memory of 4508 216 4C7A.tmp 85 PID 4508 wrote to memory of 4180 4508 4D16.tmp 86 PID 4508 wrote to memory of 4180 4508 4D16.tmp 86 PID 4508 wrote to memory of 4180 4508 4D16.tmp 86 PID 4180 wrote to memory of 4848 4180 4D74.tmp 87 PID 4180 wrote to memory of 4848 4180 4D74.tmp 87 PID 4180 wrote to memory of 4848 4180 4D74.tmp 87 PID 4848 wrote to memory of 2696 4848 4E3F.tmp 89 PID 4848 wrote to memory of 2696 4848 4E3F.tmp 89 PID 4848 wrote to memory of 2696 4848 4E3F.tmp 89 PID 2696 wrote to memory of 988 2696 4EBC.tmp 90 PID 2696 wrote to memory of 988 2696 4EBC.tmp 90 PID 2696 wrote to memory of 988 2696 4EBC.tmp 90 PID 988 wrote to memory of 1752 988 4F49.tmp 91 PID 988 wrote to memory of 1752 988 4F49.tmp 91 PID 988 wrote to memory of 1752 988 4F49.tmp 91 PID 1752 wrote to memory of 5048 1752 4FC6.tmp 92 PID 1752 wrote to memory of 5048 1752 4FC6.tmp 92 PID 1752 wrote to memory of 5048 1752 4FC6.tmp 92 PID 5048 wrote to memory of 2196 5048 5072.tmp 93 PID 5048 wrote to memory of 2196 5048 5072.tmp 93 PID 5048 wrote to memory of 2196 5048 5072.tmp 93 PID 2196 wrote to memory of 4308 2196 510E.tmp 94 PID 2196 wrote to memory of 4308 2196 510E.tmp 94 PID 2196 wrote to memory of 4308 2196 510E.tmp 94 PID 4308 wrote to memory of 5092 4308 51AA.tmp 95 PID 4308 wrote to memory of 5092 4308 51AA.tmp 95 PID 4308 wrote to memory of 5092 4308 51AA.tmp 95 PID 5092 wrote to memory of 4016 5092 5217.tmp 96 PID 5092 wrote to memory of 4016 5092 5217.tmp 96 PID 5092 wrote to memory of 4016 5092 5217.tmp 96 PID 4016 wrote to memory of 3668 4016 5285.tmp 97 PID 4016 wrote to memory of 3668 4016 5285.tmp 97 PID 4016 wrote to memory of 3668 4016 5285.tmp 97 PID 3668 wrote to memory of 5044 3668 52F2.tmp 98 PID 3668 wrote to memory of 5044 3668 52F2.tmp 98 PID 3668 wrote to memory of 5044 3668 52F2.tmp 98 PID 5044 wrote to memory of 1224 5044 537F.tmp 99 PID 5044 wrote to memory of 1224 5044 537F.tmp 99 PID 5044 wrote to memory of 1224 5044 537F.tmp 99 PID 1224 wrote to memory of 4576 1224 53FC.tmp 100 PID 1224 wrote to memory of 4576 1224 53FC.tmp 100 PID 1224 wrote to memory of 4576 1224 53FC.tmp 100 PID 4576 wrote to memory of 2568 4576 5469.tmp 101 PID 4576 wrote to memory of 2568 4576 5469.tmp 101 PID 4576 wrote to memory of 2568 4576 5469.tmp 101 PID 2568 wrote to memory of 4436 2568 5505.tmp 102 PID 2568 wrote to memory of 4436 2568 5505.tmp 102 PID 2568 wrote to memory of 4436 2568 5505.tmp 102 PID 4436 wrote to memory of 548 4436 5573.tmp 103 PID 4436 wrote to memory of 548 4436 5573.tmp 103 PID 4436 wrote to memory of 548 4436 5573.tmp 103 PID 548 wrote to memory of 3248 548 55E0.tmp 104 PID 548 wrote to memory of 3248 548 55E0.tmp 104 PID 548 wrote to memory of 3248 548 55E0.tmp 104 PID 3248 wrote to memory of 3188 3248 565D.tmp 105 PID 3248 wrote to memory of 3188 3248 565D.tmp 105 PID 3248 wrote to memory of 3188 3248 565D.tmp 105 PID 3188 wrote to memory of 4596 3188 56CB.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_a9f2505f7fde42b290f331d183c060af_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"23⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"24⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"25⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"26⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"27⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"28⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"29⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"30⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"31⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"32⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"33⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"34⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"35⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"36⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"37⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"38⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"39⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"40⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"41⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"42⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"43⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"44⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"45⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"46⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"47⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"48⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"49⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"50⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"51⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"52⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"53⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"54⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"55⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"56⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"57⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"58⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"59⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"60⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"61⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"62⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"63⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"64⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"65⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"66⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"67⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"68⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"69⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"70⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"71⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"72⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"73⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"74⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"75⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"76⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"77⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"78⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"79⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"80⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"81⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"82⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"83⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"84⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"86⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"87⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"88⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"89⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"90⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"91⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"92⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"93⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"94⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"95⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"96⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"97⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"99⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"100⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"101⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"103⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"104⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"105⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"106⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"107⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"108⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"109⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"110⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"111⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"112⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"113⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"114⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"115⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"116⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"117⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"118⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"119⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"120⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"121⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-