Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe
-
Size
541KB
-
MD5
34e5c7ec2f1ac336ad2d38d47c4f6948
-
SHA1
3a91aac81a706d00a5a3e6f043afb092322ef6f8
-
SHA256
793016922d7f8e54cfe3916eb35de0b2e9581ae965b1d43680fe906de9a09a29
-
SHA512
aa85baa66254ac1dea4ba4ca41a9e50393a4c0594374b24e8aa254d6cdb6fdad1880c4f13988761659e60a0c0ce75fdebb26adc52cbc49d321c4353a9cf10ce8
-
SSDEEP
12288:UU5rCOTeifPmLcojg80399cNstYUPmCF3hW6rZa73ctO:UUQOJfPmJacWqmPy6rU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1492 4D74.tmp 4584 4E10.tmp 2028 4E9D.tmp 224 4F29.tmp 3016 4F87.tmp 4000 4FF5.tmp 4292 5052.tmp 4344 50CF.tmp 1940 512D.tmp 852 519A.tmp 808 51E9.tmp 2012 5256.tmp 2620 52D3.tmp 3132 5331.tmp 3884 538E.tmp 4484 53FC.tmp 3512 5488.tmp 1644 54F6.tmp 4112 5554.tmp 1648 55B1.tmp 1324 561F.tmp 3376 567C.tmp 4876 56F9.tmp 5072 5757.tmp 3200 57D4.tmp 4152 5842.tmp 1432 589F.tmp 856 58FD.tmp 3544 594B.tmp 776 59A9.tmp 1388 5A07.tmp 3180 5A55.tmp 1028 5AC2.tmp 3808 5B10.tmp 4348 5B5E.tmp 2592 5BDB.tmp 4516 5C2A.tmp 3068 5C87.tmp 3820 5CE5.tmp 2744 5D43.tmp 4496 5DA1.tmp 3788 5DEF.tmp 1360 5E4C.tmp 3576 5E9B.tmp 1860 5EE9.tmp 3980 5F46.tmp 1796 5F95.tmp 4184 5FE3.tmp 4068 6031.tmp 4612 607F.tmp 2160 60CD.tmp 4388 611B.tmp 3704 6179.tmp 4560 61D7.tmp 364 6234.tmp 4616 6283.tmp 1492 62E0.tmp 1760 633E.tmp 1008 639C.tmp 212 63EA.tmp 1680 6448.tmp 4680 64A5.tmp 2216 64F4.tmp 4812 6542.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1492 1876 2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe 81 PID 1876 wrote to memory of 1492 1876 2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe 81 PID 1876 wrote to memory of 1492 1876 2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe 81 PID 1492 wrote to memory of 4584 1492 4D74.tmp 82 PID 1492 wrote to memory of 4584 1492 4D74.tmp 82 PID 1492 wrote to memory of 4584 1492 4D74.tmp 82 PID 4584 wrote to memory of 2028 4584 4E10.tmp 83 PID 4584 wrote to memory of 2028 4584 4E10.tmp 83 PID 4584 wrote to memory of 2028 4584 4E10.tmp 83 PID 2028 wrote to memory of 224 2028 4E9D.tmp 84 PID 2028 wrote to memory of 224 2028 4E9D.tmp 84 PID 2028 wrote to memory of 224 2028 4E9D.tmp 84 PID 224 wrote to memory of 3016 224 4F29.tmp 85 PID 224 wrote to memory of 3016 224 4F29.tmp 85 PID 224 wrote to memory of 3016 224 4F29.tmp 85 PID 3016 wrote to memory of 4000 3016 4F87.tmp 86 PID 3016 wrote to memory of 4000 3016 4F87.tmp 86 PID 3016 wrote to memory of 4000 3016 4F87.tmp 86 PID 4000 wrote to memory of 4292 4000 4FF5.tmp 87 PID 4000 wrote to memory of 4292 4000 4FF5.tmp 87 PID 4000 wrote to memory of 4292 4000 4FF5.tmp 87 PID 4292 wrote to memory of 4344 4292 5052.tmp 88 PID 4292 wrote to memory of 4344 4292 5052.tmp 88 PID 4292 wrote to memory of 4344 4292 5052.tmp 88 PID 4344 wrote to memory of 1940 4344 50CF.tmp 89 PID 4344 wrote to memory of 1940 4344 50CF.tmp 89 PID 4344 wrote to memory of 1940 4344 50CF.tmp 89 PID 1940 wrote to memory of 852 1940 512D.tmp 90 PID 1940 wrote to memory of 852 1940 512D.tmp 90 PID 1940 wrote to memory of 852 1940 512D.tmp 90 PID 852 wrote to memory of 808 852 519A.tmp 91 PID 852 wrote to memory of 808 852 519A.tmp 91 PID 852 wrote to memory of 808 852 519A.tmp 91 PID 808 wrote to memory of 2012 808 51E9.tmp 92 PID 808 wrote to memory of 2012 808 51E9.tmp 92 PID 808 wrote to memory of 2012 808 51E9.tmp 92 PID 2012 wrote to memory of 2620 2012 5256.tmp 93 PID 2012 wrote to memory of 2620 2012 5256.tmp 93 PID 2012 wrote to memory of 2620 2012 5256.tmp 93 PID 2620 wrote to memory of 3132 2620 52D3.tmp 94 PID 2620 wrote to memory of 3132 2620 52D3.tmp 94 PID 2620 wrote to memory of 3132 2620 52D3.tmp 94 PID 3132 wrote to memory of 3884 3132 5331.tmp 95 PID 3132 wrote to memory of 3884 3132 5331.tmp 95 PID 3132 wrote to memory of 3884 3132 5331.tmp 95 PID 3884 wrote to memory of 4484 3884 538E.tmp 96 PID 3884 wrote to memory of 4484 3884 538E.tmp 96 PID 3884 wrote to memory of 4484 3884 538E.tmp 96 PID 4484 wrote to memory of 3512 4484 53FC.tmp 97 PID 4484 wrote to memory of 3512 4484 53FC.tmp 97 PID 4484 wrote to memory of 3512 4484 53FC.tmp 97 PID 3512 wrote to memory of 1644 3512 5488.tmp 98 PID 3512 wrote to memory of 1644 3512 5488.tmp 98 PID 3512 wrote to memory of 1644 3512 5488.tmp 98 PID 1644 wrote to memory of 4112 1644 54F6.tmp 99 PID 1644 wrote to memory of 4112 1644 54F6.tmp 99 PID 1644 wrote to memory of 4112 1644 54F6.tmp 99 PID 4112 wrote to memory of 1648 4112 5554.tmp 100 PID 4112 wrote to memory of 1648 4112 5554.tmp 100 PID 4112 wrote to memory of 1648 4112 5554.tmp 100 PID 1648 wrote to memory of 1324 1648 55B1.tmp 101 PID 1648 wrote to memory of 1324 1648 55B1.tmp 101 PID 1648 wrote to memory of 1324 1648 55B1.tmp 101 PID 1324 wrote to memory of 3376 1324 561F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_34e5c7ec2f1ac336ad2d38d47c4f6948_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"23⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"24⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"25⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"26⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"27⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"28⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"29⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"30⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"31⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"32⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"33⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"34⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"35⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"36⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"37⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"38⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"39⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"40⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"41⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"42⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"43⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"45⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"46⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"47⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"48⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"49⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"50⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"51⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"52⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"53⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"54⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"55⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"56⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"57⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"58⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"59⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"60⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"61⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"62⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"63⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"64⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"65⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"66⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"67⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"68⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"69⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"70⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"71⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"72⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"73⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"74⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"75⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"76⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"77⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"78⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"79⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"80⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"81⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"82⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"83⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"84⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"85⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"86⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"87⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"88⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"89⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"90⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"91⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"92⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"94⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"95⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"96⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"97⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"98⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"99⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"100⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"101⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"102⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"103⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"104⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"105⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"106⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"107⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"108⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"109⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"110⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"111⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"112⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"113⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"114⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"115⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"116⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"118⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"119⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"120⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"121⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"122⤵PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-