Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 08:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
-
Size
488KB
-
MD5
6b902c4731b5ae4abfd64bf8c13de767
-
SHA1
494f43cc4518a9e44155901ce2dcb3b489b2577e
-
SHA256
31ee9d2889fe3d663b671548a5d969f76fcd6d5afe385e367baada58b35f48ef
-
SHA512
34a429951c60a9c6f1c6c9973e1cf6bbf91702eacd8e196e62389dce594438c8383b99cc2a40893d6ae880480cbd1823aaa6ab775520ba2ece5519176ee80fe2
-
SSDEEP
12288:/U5rCOTeiDz0EBtugRS8EBtz/+34Je8kI5z5uNZ:/UQOJDzd/RI/z/y4Je3eFuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4844 514C.tmp 4608 51AA.tmp 1992 5237.tmp 2096 52A4.tmp 3932 5311.tmp 824 537F.tmp 2380 53DD.tmp 3600 545A.tmp 1260 54A8.tmp 4648 5505.tmp 636 5563.tmp 4996 55C1.tmp 1524 563E.tmp 3276 56BB.tmp 1056 5709.tmp 4056 5786.tmp 3328 5803.tmp 3212 5870.tmp 3516 58ED.tmp 648 596A.tmp 980 59D8.tmp 2512 5A55.tmp 3460 5AB3.tmp 4864 5B20.tmp 1388 5B6E.tmp 3576 5BCC.tmp 2128 5C39.tmp 5072 5C97.tmp 1668 5CF5.tmp 3596 5D52.tmp 3704 5DB0.tmp 1628 5DFE.tmp 3196 5E5C.tmp 3768 5EAA.tmp 4288 5EF8.tmp 544 5F56.tmp 4764 5FA4.tmp 3624 5FF2.tmp 3356 6040.tmp 1248 608F.tmp 4652 60DD.tmp 1880 612B.tmp 2384 6179.tmp 2616 61C7.tmp 1964 6215.tmp 1052 6263.tmp 2744 62B1.tmp 1540 630F.tmp 4908 636D.tmp 928 63BB.tmp 3080 6409.tmp 384 6467.tmp 3736 64B5.tmp 4404 6513.tmp 5052 6561.tmp 208 65AF.tmp 3268 65FD.tmp 3780 664B.tmp 4920 6699.tmp 4220 66E8.tmp 3060 6726.tmp 2400 6774.tmp 1800 67C2.tmp 4204 6810.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4844 2972 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 82 PID 2972 wrote to memory of 4844 2972 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 82 PID 2972 wrote to memory of 4844 2972 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 82 PID 4844 wrote to memory of 4608 4844 514C.tmp 83 PID 4844 wrote to memory of 4608 4844 514C.tmp 83 PID 4844 wrote to memory of 4608 4844 514C.tmp 83 PID 4608 wrote to memory of 1992 4608 51AA.tmp 86 PID 4608 wrote to memory of 1992 4608 51AA.tmp 86 PID 4608 wrote to memory of 1992 4608 51AA.tmp 86 PID 1992 wrote to memory of 2096 1992 5237.tmp 88 PID 1992 wrote to memory of 2096 1992 5237.tmp 88 PID 1992 wrote to memory of 2096 1992 5237.tmp 88 PID 2096 wrote to memory of 3932 2096 52A4.tmp 89 PID 2096 wrote to memory of 3932 2096 52A4.tmp 89 PID 2096 wrote to memory of 3932 2096 52A4.tmp 89 PID 3932 wrote to memory of 824 3932 5311.tmp 90 PID 3932 wrote to memory of 824 3932 5311.tmp 90 PID 3932 wrote to memory of 824 3932 5311.tmp 90 PID 824 wrote to memory of 2380 824 537F.tmp 91 PID 824 wrote to memory of 2380 824 537F.tmp 91 PID 824 wrote to memory of 2380 824 537F.tmp 91 PID 2380 wrote to memory of 3600 2380 53DD.tmp 92 PID 2380 wrote to memory of 3600 2380 53DD.tmp 92 PID 2380 wrote to memory of 3600 2380 53DD.tmp 92 PID 3600 wrote to memory of 1260 3600 545A.tmp 93 PID 3600 wrote to memory of 1260 3600 545A.tmp 93 PID 3600 wrote to memory of 1260 3600 545A.tmp 93 PID 1260 wrote to memory of 4648 1260 54A8.tmp 94 PID 1260 wrote to memory of 4648 1260 54A8.tmp 94 PID 1260 wrote to memory of 4648 1260 54A8.tmp 94 PID 4648 wrote to memory of 636 4648 5505.tmp 95 PID 4648 wrote to memory of 636 4648 5505.tmp 95 PID 4648 wrote to memory of 636 4648 5505.tmp 95 PID 636 wrote to memory of 4996 636 5563.tmp 96 PID 636 wrote to memory of 4996 636 5563.tmp 96 PID 636 wrote to memory of 4996 636 5563.tmp 96 PID 4996 wrote to memory of 1524 4996 55C1.tmp 97 PID 4996 wrote to memory of 1524 4996 55C1.tmp 97 PID 4996 wrote to memory of 1524 4996 55C1.tmp 97 PID 1524 wrote to memory of 3276 1524 563E.tmp 98 PID 1524 wrote to memory of 3276 1524 563E.tmp 98 PID 1524 wrote to memory of 3276 1524 563E.tmp 98 PID 3276 wrote to memory of 1056 3276 56BB.tmp 99 PID 3276 wrote to memory of 1056 3276 56BB.tmp 99 PID 3276 wrote to memory of 1056 3276 56BB.tmp 99 PID 1056 wrote to memory of 4056 1056 5709.tmp 100 PID 1056 wrote to memory of 4056 1056 5709.tmp 100 PID 1056 wrote to memory of 4056 1056 5709.tmp 100 PID 4056 wrote to memory of 3328 4056 5786.tmp 101 PID 4056 wrote to memory of 3328 4056 5786.tmp 101 PID 4056 wrote to memory of 3328 4056 5786.tmp 101 PID 3328 wrote to memory of 3212 3328 5803.tmp 102 PID 3328 wrote to memory of 3212 3328 5803.tmp 102 PID 3328 wrote to memory of 3212 3328 5803.tmp 102 PID 3212 wrote to memory of 3516 3212 5870.tmp 103 PID 3212 wrote to memory of 3516 3212 5870.tmp 103 PID 3212 wrote to memory of 3516 3212 5870.tmp 103 PID 3516 wrote to memory of 648 3516 58ED.tmp 104 PID 3516 wrote to memory of 648 3516 58ED.tmp 104 PID 3516 wrote to memory of 648 3516 58ED.tmp 104 PID 648 wrote to memory of 980 648 596A.tmp 105 PID 648 wrote to memory of 980 648 596A.tmp 105 PID 648 wrote to memory of 980 648 596A.tmp 105 PID 980 wrote to memory of 2512 980 59D8.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"23⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"24⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"25⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"26⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"27⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"28⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"29⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"30⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"31⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"32⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"33⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"34⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"35⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"36⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"37⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"38⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"39⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"40⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"41⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"42⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"43⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"44⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"45⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"46⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"47⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"48⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"49⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"50⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"51⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"52⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"53⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"54⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"55⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"56⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"57⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"58⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"59⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"60⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"61⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"62⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"63⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"64⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"65⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"66⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"67⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"68⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"69⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"70⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"71⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"72⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"73⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"74⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"75⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"76⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"77⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"78⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"79⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"80⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"81⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"82⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"83⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"84⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"85⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"86⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"87⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"88⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"89⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"90⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"91⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"92⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"93⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"94⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"95⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"96⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"97⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"98⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"99⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"100⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"101⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"102⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"103⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"104⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"105⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"106⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"107⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"108⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"109⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"110⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"111⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"112⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"113⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"114⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"115⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"116⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"117⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"119⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"120⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"121⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-