Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 08:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe
-
Size
488KB
-
MD5
94aec6841db6e4033248e6dcf7f6c50c
-
SHA1
e0b34593aa024a2da0b79b0286df9823e71e6198
-
SHA256
f66eb23c0d7ba8b14909844e44c0243a85cbfd4a375806494d1a2f78f28dd877
-
SHA512
b361ec69adb6bdd2f10c9aaaec1b99b834815e178f5eb16edcab540d6470226ff5b0545ba2b863289ec978ced12325260a7e6dc7193738853742b4be92b9c2b9
-
SSDEEP
12288:/U5rCOTeiD66BJ88d5QshZdzHV0HDCeEF6RzazoKNZ:/UQOJD60JdHQsnv1MRGdN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1168 4631.tmp 968 46BD.tmp 2504 473A.tmp 1112 47A8.tmp 4492 4825.tmp 5008 4892.tmp 4996 48F0.tmp 2724 494D.tmp 2268 49BB.tmp 2068 4A38.tmp 2804 4AB5.tmp 4060 4B22.tmp 1736 4B70.tmp 676 4BED.tmp 4612 4C6A.tmp 3284 4D07.tmp 5100 4D64.tmp 3104 4DD2.tmp 3124 4E2F.tmp 2672 4E7E.tmp 2904 4EDB.tmp 1244 4F39.tmp 4992 4F97.tmp 1200 5014.tmp 1248 5062.tmp 2360 50C0.tmp 3288 511D.tmp 380 518B.tmp 2932 5208.tmp 5016 5275.tmp 944 52C3.tmp 2968 5321.tmp 1660 537F.tmp 3280 53DD.tmp 4120 542B.tmp 4484 54A8.tmp 1872 5515.tmp 3588 5563.tmp 4116 55B1.tmp 2472 560F.tmp 2468 566D.tmp 4860 56BB.tmp 4136 5719.tmp 3392 5776.tmp 4976 57D4.tmp 4008 5832.tmp 1580 5880.tmp 4460 58CE.tmp 2428 591C.tmp 4616 59C8.tmp 32 5A16.tmp 2236 5A74.tmp 1020 5AC2.tmp 4968 5B20.tmp 772 5B6E.tmp 2664 5BBC.tmp 2184 5C0A.tmp 4688 5C68.tmp 2832 5CB6.tmp 1400 5D14.tmp 2368 5D72.tmp 5008 5DC0.tmp 2132 5E1E.tmp 4488 5E6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1168 1148 2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe 82 PID 1148 wrote to memory of 1168 1148 2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe 82 PID 1148 wrote to memory of 1168 1148 2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe 82 PID 1168 wrote to memory of 968 1168 4631.tmp 84 PID 1168 wrote to memory of 968 1168 4631.tmp 84 PID 1168 wrote to memory of 968 1168 4631.tmp 84 PID 968 wrote to memory of 2504 968 46BD.tmp 86 PID 968 wrote to memory of 2504 968 46BD.tmp 86 PID 968 wrote to memory of 2504 968 46BD.tmp 86 PID 2504 wrote to memory of 1112 2504 473A.tmp 87 PID 2504 wrote to memory of 1112 2504 473A.tmp 87 PID 2504 wrote to memory of 1112 2504 473A.tmp 87 PID 1112 wrote to memory of 4492 1112 47A8.tmp 89 PID 1112 wrote to memory of 4492 1112 47A8.tmp 89 PID 1112 wrote to memory of 4492 1112 47A8.tmp 89 PID 4492 wrote to memory of 5008 4492 4825.tmp 90 PID 4492 wrote to memory of 5008 4492 4825.tmp 90 PID 4492 wrote to memory of 5008 4492 4825.tmp 90 PID 5008 wrote to memory of 4996 5008 4892.tmp 91 PID 5008 wrote to memory of 4996 5008 4892.tmp 91 PID 5008 wrote to memory of 4996 5008 4892.tmp 91 PID 4996 wrote to memory of 2724 4996 48F0.tmp 92 PID 4996 wrote to memory of 2724 4996 48F0.tmp 92 PID 4996 wrote to memory of 2724 4996 48F0.tmp 92 PID 2724 wrote to memory of 2268 2724 494D.tmp 93 PID 2724 wrote to memory of 2268 2724 494D.tmp 93 PID 2724 wrote to memory of 2268 2724 494D.tmp 93 PID 2268 wrote to memory of 2068 2268 49BB.tmp 94 PID 2268 wrote to memory of 2068 2268 49BB.tmp 94 PID 2268 wrote to memory of 2068 2268 49BB.tmp 94 PID 2068 wrote to memory of 2804 2068 4A38.tmp 95 PID 2068 wrote to memory of 2804 2068 4A38.tmp 95 PID 2068 wrote to memory of 2804 2068 4A38.tmp 95 PID 2804 wrote to memory of 4060 2804 4AB5.tmp 96 PID 2804 wrote to memory of 4060 2804 4AB5.tmp 96 PID 2804 wrote to memory of 4060 2804 4AB5.tmp 96 PID 4060 wrote to memory of 1736 4060 4B22.tmp 97 PID 4060 wrote to memory of 1736 4060 4B22.tmp 97 PID 4060 wrote to memory of 1736 4060 4B22.tmp 97 PID 1736 wrote to memory of 676 1736 4B70.tmp 98 PID 1736 wrote to memory of 676 1736 4B70.tmp 98 PID 1736 wrote to memory of 676 1736 4B70.tmp 98 PID 676 wrote to memory of 4612 676 4BED.tmp 99 PID 676 wrote to memory of 4612 676 4BED.tmp 99 PID 676 wrote to memory of 4612 676 4BED.tmp 99 PID 4612 wrote to memory of 3284 4612 4C6A.tmp 101 PID 4612 wrote to memory of 3284 4612 4C6A.tmp 101 PID 4612 wrote to memory of 3284 4612 4C6A.tmp 101 PID 3284 wrote to memory of 5100 3284 4D07.tmp 102 PID 3284 wrote to memory of 5100 3284 4D07.tmp 102 PID 3284 wrote to memory of 5100 3284 4D07.tmp 102 PID 5100 wrote to memory of 3104 5100 4D64.tmp 103 PID 5100 wrote to memory of 3104 5100 4D64.tmp 103 PID 5100 wrote to memory of 3104 5100 4D64.tmp 103 PID 3104 wrote to memory of 3124 3104 4DD2.tmp 104 PID 3104 wrote to memory of 3124 3104 4DD2.tmp 104 PID 3104 wrote to memory of 3124 3104 4DD2.tmp 104 PID 3124 wrote to memory of 2672 3124 4E2F.tmp 105 PID 3124 wrote to memory of 2672 3124 4E2F.tmp 105 PID 3124 wrote to memory of 2672 3124 4E2F.tmp 105 PID 2672 wrote to memory of 2904 2672 4E7E.tmp 106 PID 2672 wrote to memory of 2904 2672 4E7E.tmp 106 PID 2672 wrote to memory of 2904 2672 4E7E.tmp 106 PID 2904 wrote to memory of 1244 2904 4EDB.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_94aec6841db6e4033248e6dcf7f6c50c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"23⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"24⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"25⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"26⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"27⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"28⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"29⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"30⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"32⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"33⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"34⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"35⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"36⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"37⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"38⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"39⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"40⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"41⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"42⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"43⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"44⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"45⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"46⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"47⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"48⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"49⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"50⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"51⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"52⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"53⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"54⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"55⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"56⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"57⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"58⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"59⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"60⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"61⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"62⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"63⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"64⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"65⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"66⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"67⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"68⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"69⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"70⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"71⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"72⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"73⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"74⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"75⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"76⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"77⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"78⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"79⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"80⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"81⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"82⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"83⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"84⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"85⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"86⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"87⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"88⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"89⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"90⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"91⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"92⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"93⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"94⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"95⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"96⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"97⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"98⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"99⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"100⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"102⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"103⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"104⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"105⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"106⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"107⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"108⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"109⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"110⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"111⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"112⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"113⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"114⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"115⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"116⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"117⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"118⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"119⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"120⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"121⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"122⤵PID:4220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-