Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe
-
Size
527KB
-
MD5
6dc2540b8a3026e3d916390004b44631
-
SHA1
4e84774c759d73da12bdec23fa527916246fce3c
-
SHA256
7b6528587e9e0f3d3a7e38b4d49ff563fdf7a185f43783d74ddbed08e0c26279
-
SHA512
0295ae0d3f4c22791dfbef82c4e90d316bc95ee93ddb0afa53cb805517a69ded514da4f19c059a1a8d856822cc53f59ac437f04df70ab147fa514a3c17d824f8
-
SSDEEP
12288:fU5rCOTeid1kLJ5KKXWq+vuq8aCFUFIwrGIUhoQDyL6oDZu:fUQOJdmL9Wq+2qZsUFIjIUiGoDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1520 4A86.tmp 4880 4B03.tmp 812 4B61.tmp 1412 4BED.tmp 4684 4C3B.tmp 4964 4C8A.tmp 1112 4CE7.tmp 2844 4D64.tmp 924 4DB2.tmp 216 4E10.tmp 1048 4E5E.tmp 2756 4EAC.tmp 1132 4EFB.tmp 4776 4F49.tmp 4928 4F87.tmp 2700 4FF5.tmp 3864 5072.tmp 4260 50C0.tmp 2696 510E.tmp 2340 515C.tmp 3200 51AA.tmp 3856 51F8.tmp 1780 5266.tmp 2488 52A4.tmp 3888 5311.tmp 388 5360.tmp 1248 53AE.tmp 3084 53FC.tmp 1460 5469.tmp 1448 54B7.tmp 2120 5525.tmp 2616 5573.tmp 1388 55C1.tmp 4868 560F.tmp 4072 565D.tmp 4640 56AB.tmp 4116 56F9.tmp 4488 5748.tmp 4720 57A5.tmp 4416 57F3.tmp 1200 5842.tmp 4320 5890.tmp 2676 58DE.tmp 3208 593C.tmp 1784 598A.tmp 2648 59D8.tmp 2672 5A26.tmp 4748 5A74.tmp 4044 5AC2.tmp 4668 5B10.tmp 4192 5B5E.tmp 1920 5BAD.tmp 4688 5BFB.tmp 876 5C49.tmp 2156 5C97.tmp 3212 5CE5.tmp 2040 5D33.tmp 3500 5DA1.tmp 4708 5DEF.tmp 4124 5E3D.tmp 4252 5E8B.tmp 2084 5ED9.tmp 1192 5F27.tmp 1376 5F75.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1520 1464 2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe 81 PID 1464 wrote to memory of 1520 1464 2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe 81 PID 1464 wrote to memory of 1520 1464 2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe 81 PID 1520 wrote to memory of 4880 1520 4A86.tmp 82 PID 1520 wrote to memory of 4880 1520 4A86.tmp 82 PID 1520 wrote to memory of 4880 1520 4A86.tmp 82 PID 4880 wrote to memory of 812 4880 4B03.tmp 83 PID 4880 wrote to memory of 812 4880 4B03.tmp 83 PID 4880 wrote to memory of 812 4880 4B03.tmp 83 PID 812 wrote to memory of 1412 812 4B61.tmp 84 PID 812 wrote to memory of 1412 812 4B61.tmp 84 PID 812 wrote to memory of 1412 812 4B61.tmp 84 PID 1412 wrote to memory of 4684 1412 4BED.tmp 85 PID 1412 wrote to memory of 4684 1412 4BED.tmp 85 PID 1412 wrote to memory of 4684 1412 4BED.tmp 85 PID 4684 wrote to memory of 4964 4684 4C3B.tmp 86 PID 4684 wrote to memory of 4964 4684 4C3B.tmp 86 PID 4684 wrote to memory of 4964 4684 4C3B.tmp 86 PID 4964 wrote to memory of 1112 4964 4C8A.tmp 87 PID 4964 wrote to memory of 1112 4964 4C8A.tmp 87 PID 4964 wrote to memory of 1112 4964 4C8A.tmp 87 PID 1112 wrote to memory of 2844 1112 4CE7.tmp 88 PID 1112 wrote to memory of 2844 1112 4CE7.tmp 88 PID 1112 wrote to memory of 2844 1112 4CE7.tmp 88 PID 2844 wrote to memory of 924 2844 4D64.tmp 89 PID 2844 wrote to memory of 924 2844 4D64.tmp 89 PID 2844 wrote to memory of 924 2844 4D64.tmp 89 PID 924 wrote to memory of 216 924 4DB2.tmp 90 PID 924 wrote to memory of 216 924 4DB2.tmp 90 PID 924 wrote to memory of 216 924 4DB2.tmp 90 PID 216 wrote to memory of 1048 216 4E10.tmp 91 PID 216 wrote to memory of 1048 216 4E10.tmp 91 PID 216 wrote to memory of 1048 216 4E10.tmp 91 PID 1048 wrote to memory of 2756 1048 4E5E.tmp 92 PID 1048 wrote to memory of 2756 1048 4E5E.tmp 92 PID 1048 wrote to memory of 2756 1048 4E5E.tmp 92 PID 2756 wrote to memory of 1132 2756 4EAC.tmp 93 PID 2756 wrote to memory of 1132 2756 4EAC.tmp 93 PID 2756 wrote to memory of 1132 2756 4EAC.tmp 93 PID 1132 wrote to memory of 4776 1132 4EFB.tmp 94 PID 1132 wrote to memory of 4776 1132 4EFB.tmp 94 PID 1132 wrote to memory of 4776 1132 4EFB.tmp 94 PID 4776 wrote to memory of 4928 4776 4F49.tmp 95 PID 4776 wrote to memory of 4928 4776 4F49.tmp 95 PID 4776 wrote to memory of 4928 4776 4F49.tmp 95 PID 4928 wrote to memory of 2700 4928 4F87.tmp 96 PID 4928 wrote to memory of 2700 4928 4F87.tmp 96 PID 4928 wrote to memory of 2700 4928 4F87.tmp 96 PID 2700 wrote to memory of 3864 2700 4FF5.tmp 97 PID 2700 wrote to memory of 3864 2700 4FF5.tmp 97 PID 2700 wrote to memory of 3864 2700 4FF5.tmp 97 PID 3864 wrote to memory of 4260 3864 5072.tmp 98 PID 3864 wrote to memory of 4260 3864 5072.tmp 98 PID 3864 wrote to memory of 4260 3864 5072.tmp 98 PID 4260 wrote to memory of 2696 4260 50C0.tmp 99 PID 4260 wrote to memory of 2696 4260 50C0.tmp 99 PID 4260 wrote to memory of 2696 4260 50C0.tmp 99 PID 2696 wrote to memory of 2340 2696 510E.tmp 100 PID 2696 wrote to memory of 2340 2696 510E.tmp 100 PID 2696 wrote to memory of 2340 2696 510E.tmp 100 PID 2340 wrote to memory of 3200 2340 515C.tmp 101 PID 2340 wrote to memory of 3200 2340 515C.tmp 101 PID 2340 wrote to memory of 3200 2340 515C.tmp 101 PID 3200 wrote to memory of 3856 3200 51AA.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_6dc2540b8a3026e3d916390004b44631_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"23⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"24⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"25⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"26⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"27⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"28⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"29⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"30⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"31⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"32⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"33⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"34⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"35⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"36⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"37⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"38⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"39⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"40⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"41⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"42⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"43⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"44⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"45⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"46⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"47⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"48⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"49⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"50⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"51⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"52⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"53⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"54⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"55⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"56⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"57⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"58⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"59⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"60⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"61⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"62⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"63⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"64⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"65⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"66⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"67⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"69⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"70⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"72⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"73⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"74⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"75⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"76⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"77⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"78⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"79⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"80⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"81⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"82⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"83⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"84⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"85⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"86⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"87⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"88⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"89⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"90⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"91⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"92⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"93⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"94⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"95⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"96⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"97⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"98⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"99⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"100⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"101⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"102⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"103⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"104⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"105⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"106⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"107⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"108⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"109⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"110⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"111⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"112⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"113⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"114⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"115⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"116⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"117⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"118⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"119⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"120⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"121⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"122⤵PID:3228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-