Analysis
-
max time kernel
128s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 13:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe
-
Size
488KB
-
MD5
ac0853aaf68e77d46b53c3543c2d4662
-
SHA1
0d9af1fe1288cec24ea848c55ed736f31d289ac4
-
SHA256
74fb012069ad646820c18a4fb1707c250839cafd60fc108be55d5041b3247cf6
-
SHA512
e88e30f33a96fd5204c56f7384743220586b551059b0089f870588d4035b82561f870ea969089f725c0564a51baba80ecf89163a653d54c86021f6ae782fc442
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7OBhBvJO6r23GV/gdAKj4V48GgcK7NVzn1Bhn:/U5rCOTeiDwBROkBpgdiV48TXBlNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4192 512D.tmp 1736 517B.tmp 2332 51C9.tmp 2512 5217.tmp 1568 5266.tmp 3640 52B4.tmp 4880 5302.tmp 1308 5350.tmp 2268 539E.tmp 2564 53EC.tmp 3128 543A.tmp 4196 5498.tmp 2356 54F6.tmp 1168 5544.tmp 1252 5592.tmp 964 55E0.tmp 3388 562E.tmp 3656 567C.tmp 1240 56CB.tmp 3448 5719.tmp 4720 5767.tmp 4656 57B5.tmp 3732 5803.tmp 4020 5890.tmp 3096 58DE.tmp 1640 592C.tmp 3972 597A.tmp 972 59C8.tmp 4860 5A16.tmp 3548 5A64.tmp 4484 5AB3.tmp 4816 5B10.tmp 2252 5B5E.tmp 2640 5BAD.tmp 3840 5BFB.tmp 3168 5C49.tmp 244 5C97.tmp 4948 5CD5.tmp 4180 5D24.tmp 2616 5D72.tmp 884 5DC0.tmp 3988 5DFE.tmp 2824 5E4C.tmp 1848 5E9B.tmp 4552 5EE9.tmp 3880 5F37.tmp 1656 5F85.tmp 1264 5FD3.tmp 2884 6021.tmp 2608 606F.tmp 3476 60BD.tmp 4312 610C.tmp 1964 615A.tmp 3816 61A8.tmp 2448 61E6.tmp 3524 6225.tmp 1668 6263.tmp 4992 62B1.tmp 3516 6300.tmp 396 633E.tmp 2092 638C.tmp 3436 63CB.tmp 2720 6409.tmp 4912 6457.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 4192 4368 2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe 80 PID 4368 wrote to memory of 4192 4368 2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe 80 PID 4368 wrote to memory of 4192 4368 2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe 80 PID 4192 wrote to memory of 1736 4192 512D.tmp 81 PID 4192 wrote to memory of 1736 4192 512D.tmp 81 PID 4192 wrote to memory of 1736 4192 512D.tmp 81 PID 1736 wrote to memory of 2332 1736 517B.tmp 82 PID 1736 wrote to memory of 2332 1736 517B.tmp 82 PID 1736 wrote to memory of 2332 1736 517B.tmp 82 PID 2332 wrote to memory of 2512 2332 51C9.tmp 83 PID 2332 wrote to memory of 2512 2332 51C9.tmp 83 PID 2332 wrote to memory of 2512 2332 51C9.tmp 83 PID 2512 wrote to memory of 1568 2512 5217.tmp 84 PID 2512 wrote to memory of 1568 2512 5217.tmp 84 PID 2512 wrote to memory of 1568 2512 5217.tmp 84 PID 1568 wrote to memory of 3640 1568 5266.tmp 85 PID 1568 wrote to memory of 3640 1568 5266.tmp 85 PID 1568 wrote to memory of 3640 1568 5266.tmp 85 PID 3640 wrote to memory of 4880 3640 52B4.tmp 86 PID 3640 wrote to memory of 4880 3640 52B4.tmp 86 PID 3640 wrote to memory of 4880 3640 52B4.tmp 86 PID 4880 wrote to memory of 1308 4880 5302.tmp 87 PID 4880 wrote to memory of 1308 4880 5302.tmp 87 PID 4880 wrote to memory of 1308 4880 5302.tmp 87 PID 1308 wrote to memory of 2268 1308 5350.tmp 88 PID 1308 wrote to memory of 2268 1308 5350.tmp 88 PID 1308 wrote to memory of 2268 1308 5350.tmp 88 PID 2268 wrote to memory of 2564 2268 539E.tmp 234 PID 2268 wrote to memory of 2564 2268 539E.tmp 234 PID 2268 wrote to memory of 2564 2268 539E.tmp 234 PID 2564 wrote to memory of 3128 2564 53EC.tmp 90 PID 2564 wrote to memory of 3128 2564 53EC.tmp 90 PID 2564 wrote to memory of 3128 2564 53EC.tmp 90 PID 3128 wrote to memory of 4196 3128 543A.tmp 91 PID 3128 wrote to memory of 4196 3128 543A.tmp 91 PID 3128 wrote to memory of 4196 3128 543A.tmp 91 PID 4196 wrote to memory of 2356 4196 5498.tmp 92 PID 4196 wrote to memory of 2356 4196 5498.tmp 92 PID 4196 wrote to memory of 2356 4196 5498.tmp 92 PID 2356 wrote to memory of 1168 2356 54F6.tmp 93 PID 2356 wrote to memory of 1168 2356 54F6.tmp 93 PID 2356 wrote to memory of 1168 2356 54F6.tmp 93 PID 1168 wrote to memory of 1252 1168 5544.tmp 94 PID 1168 wrote to memory of 1252 1168 5544.tmp 94 PID 1168 wrote to memory of 1252 1168 5544.tmp 94 PID 1252 wrote to memory of 964 1252 5592.tmp 95 PID 1252 wrote to memory of 964 1252 5592.tmp 95 PID 1252 wrote to memory of 964 1252 5592.tmp 95 PID 964 wrote to memory of 3388 964 55E0.tmp 96 PID 964 wrote to memory of 3388 964 55E0.tmp 96 PID 964 wrote to memory of 3388 964 55E0.tmp 96 PID 3388 wrote to memory of 3656 3388 562E.tmp 97 PID 3388 wrote to memory of 3656 3388 562E.tmp 97 PID 3388 wrote to memory of 3656 3388 562E.tmp 97 PID 3656 wrote to memory of 1240 3656 567C.tmp 98 PID 3656 wrote to memory of 1240 3656 567C.tmp 98 PID 3656 wrote to memory of 1240 3656 567C.tmp 98 PID 1240 wrote to memory of 3448 1240 56CB.tmp 99 PID 1240 wrote to memory of 3448 1240 56CB.tmp 99 PID 1240 wrote to memory of 3448 1240 56CB.tmp 99 PID 3448 wrote to memory of 4720 3448 5719.tmp 100 PID 3448 wrote to memory of 4720 3448 5719.tmp 100 PID 3448 wrote to memory of 4720 3448 5719.tmp 100 PID 4720 wrote to memory of 4656 4720 5767.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_ac0853aaf68e77d46b53c3543c2d4662_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"23⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"24⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"25⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"26⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"27⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"28⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"29⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"30⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"31⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"32⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"33⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"34⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"35⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"36⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"37⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"38⤵
- Executes dropped EXE
PID:244 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"39⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"40⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"41⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"42⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"43⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"45⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"46⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"47⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"48⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"49⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"50⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"51⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"52⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"53⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"54⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"55⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"56⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"57⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"58⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"59⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"60⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"61⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"62⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"63⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"64⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"65⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"66⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"67⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"68⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"69⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"70⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"71⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"72⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"73⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"74⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"75⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"76⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"77⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"78⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"79⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"80⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"81⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"82⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"83⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"84⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"85⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"86⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"87⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"88⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"89⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"90⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"91⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"92⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"93⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"94⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"95⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"96⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"97⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"98⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"99⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"100⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"101⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"102⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"103⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"104⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"105⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"106⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"107⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"108⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"109⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"110⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"111⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"112⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"113⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"114⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"115⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"116⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"117⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"118⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"119⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"120⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"121⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"122⤵PID:3628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-