Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe
-
Size
520KB
-
MD5
6760fa87277031ef72f1512a9f5d7848
-
SHA1
385c960763174796d36273b1d8c283d2cbeefa62
-
SHA256
6fab333d4db1f03779698f7067133f0a107bb3e9644458a2209cadb96c389f9c
-
SHA512
043d41860c2b1d86e3935a178364af020928f91ea183ef04300bb0e26885e4af27a109877202ff9731de6941f91b0bc7275f5a5947cf47b2fe04541ab9b278f5
-
SSDEEP
6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbowjZtAk53BWOFNtTbnMx8+KDsB4Zhr1JF:gj8fuxR21t5i8fgokrXT9DsgfGWXJNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1184 6169.tmp 2944 6206.tmp 2416 62E0.tmp 540 63BB.tmp 1004 6438.tmp 5108 64D4.tmp 4848 6561.tmp 3584 65FD.tmp 4652 668A.tmp 3204 6726.tmp 2900 67A3.tmp 436 6820.tmp 1556 687E.tmp 3320 691A.tmp 1080 69B6.tmp 1652 6A24.tmp 2572 6AC0.tmp 3808 6B2D.tmp 3672 6BCA.tmp 3340 6C47.tmp 64 6CE3.tmp 5004 6D50.tmp 2240 6DFC.tmp 1436 6E89.tmp 3464 6F15.tmp 2616 6FA2.tmp 4584 701F.tmp 5104 70AC.tmp 4732 7119.tmp 1000 7196.tmp 3980 7213.tmp 1592 72AF.tmp 2848 733C.tmp 1608 739A.tmp 3312 7436.tmp 1268 74A3.tmp 3852 74F1.tmp 2416 755F.tmp 4152 75AD.tmp 1632 761A.tmp 1212 7688.tmp 2960 76D6.tmp 1192 7733.tmp 1500 7791.tmp 2504 77FF.tmp 3768 785C.tmp 2864 78BA.tmp 4964 7927.tmp 1528 7985.tmp 3080 79E3.tmp 2424 7A31.tmp 2584 7A7F.tmp 2460 7ADD.tmp 3640 7B3B.tmp 4776 7B89.tmp 1080 7BE7.tmp 2648 7C44.tmp 3236 7CA2.tmp 2948 7D0F.tmp 3148 7D6D.tmp 4624 7DCB.tmp 4988 7E38.tmp 1356 7E96.tmp 4784 7EE4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1184 4572 2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe 83 PID 4572 wrote to memory of 1184 4572 2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe 83 PID 4572 wrote to memory of 1184 4572 2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe 83 PID 1184 wrote to memory of 2944 1184 6169.tmp 84 PID 1184 wrote to memory of 2944 1184 6169.tmp 84 PID 1184 wrote to memory of 2944 1184 6169.tmp 84 PID 2944 wrote to memory of 2416 2944 6206.tmp 85 PID 2944 wrote to memory of 2416 2944 6206.tmp 85 PID 2944 wrote to memory of 2416 2944 6206.tmp 85 PID 2416 wrote to memory of 540 2416 62E0.tmp 87 PID 2416 wrote to memory of 540 2416 62E0.tmp 87 PID 2416 wrote to memory of 540 2416 62E0.tmp 87 PID 540 wrote to memory of 1004 540 63BB.tmp 88 PID 540 wrote to memory of 1004 540 63BB.tmp 88 PID 540 wrote to memory of 1004 540 63BB.tmp 88 PID 1004 wrote to memory of 5108 1004 6438.tmp 90 PID 1004 wrote to memory of 5108 1004 6438.tmp 90 PID 1004 wrote to memory of 5108 1004 6438.tmp 90 PID 5108 wrote to memory of 4848 5108 64D4.tmp 91 PID 5108 wrote to memory of 4848 5108 64D4.tmp 91 PID 5108 wrote to memory of 4848 5108 64D4.tmp 91 PID 4848 wrote to memory of 3584 4848 6561.tmp 92 PID 4848 wrote to memory of 3584 4848 6561.tmp 92 PID 4848 wrote to memory of 3584 4848 6561.tmp 92 PID 3584 wrote to memory of 4652 3584 65FD.tmp 94 PID 3584 wrote to memory of 4652 3584 65FD.tmp 94 PID 3584 wrote to memory of 4652 3584 65FD.tmp 94 PID 4652 wrote to memory of 3204 4652 668A.tmp 95 PID 4652 wrote to memory of 3204 4652 668A.tmp 95 PID 4652 wrote to memory of 3204 4652 668A.tmp 95 PID 3204 wrote to memory of 2900 3204 6726.tmp 96 PID 3204 wrote to memory of 2900 3204 6726.tmp 96 PID 3204 wrote to memory of 2900 3204 6726.tmp 96 PID 2900 wrote to memory of 436 2900 67A3.tmp 97 PID 2900 wrote to memory of 436 2900 67A3.tmp 97 PID 2900 wrote to memory of 436 2900 67A3.tmp 97 PID 436 wrote to memory of 1556 436 6820.tmp 98 PID 436 wrote to memory of 1556 436 6820.tmp 98 PID 436 wrote to memory of 1556 436 6820.tmp 98 PID 1556 wrote to memory of 3320 1556 687E.tmp 99 PID 1556 wrote to memory of 3320 1556 687E.tmp 99 PID 1556 wrote to memory of 3320 1556 687E.tmp 99 PID 3320 wrote to memory of 1080 3320 691A.tmp 100 PID 3320 wrote to memory of 1080 3320 691A.tmp 100 PID 3320 wrote to memory of 1080 3320 691A.tmp 100 PID 1080 wrote to memory of 1652 1080 69B6.tmp 101 PID 1080 wrote to memory of 1652 1080 69B6.tmp 101 PID 1080 wrote to memory of 1652 1080 69B6.tmp 101 PID 1652 wrote to memory of 2572 1652 6A24.tmp 102 PID 1652 wrote to memory of 2572 1652 6A24.tmp 102 PID 1652 wrote to memory of 2572 1652 6A24.tmp 102 PID 2572 wrote to memory of 3808 2572 6AC0.tmp 103 PID 2572 wrote to memory of 3808 2572 6AC0.tmp 103 PID 2572 wrote to memory of 3808 2572 6AC0.tmp 103 PID 3808 wrote to memory of 3672 3808 6B2D.tmp 104 PID 3808 wrote to memory of 3672 3808 6B2D.tmp 104 PID 3808 wrote to memory of 3672 3808 6B2D.tmp 104 PID 3672 wrote to memory of 3340 3672 6BCA.tmp 105 PID 3672 wrote to memory of 3340 3672 6BCA.tmp 105 PID 3672 wrote to memory of 3340 3672 6BCA.tmp 105 PID 3340 wrote to memory of 64 3340 6C47.tmp 106 PID 3340 wrote to memory of 64 3340 6C47.tmp 106 PID 3340 wrote to memory of 64 3340 6C47.tmp 106 PID 64 wrote to memory of 5004 64 6CE3.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_6760fa87277031ef72f1512a9f5d7848_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"23⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"24⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"25⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"26⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"27⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"28⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"29⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"30⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"31⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"32⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"33⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"34⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"35⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"36⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"37⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"38⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"39⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"40⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"41⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"42⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"43⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"44⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"45⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"46⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"47⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"48⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"49⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"50⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"51⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"52⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"53⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"54⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"55⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"56⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"57⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"58⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"59⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"60⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"61⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"62⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"63⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"64⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"65⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"66⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"67⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"68⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"69⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"70⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"71⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"72⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"73⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"74⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"75⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"76⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"77⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"78⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"79⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"80⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"81⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"82⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"83⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"84⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"86⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"87⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"88⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"89⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"90⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"91⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"92⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"93⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"94⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"95⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"96⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"97⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"98⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"99⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"100⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"101⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"102⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"104⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"105⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"106⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"107⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"108⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"109⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"110⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"111⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"112⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"113⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"114⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"115⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"116⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"117⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"118⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"119⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"120⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"121⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"122⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-