Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
-
Size
527KB
-
MD5
4ed525f5f4493a8cf51499774ba454b9
-
SHA1
ac01e5482386ab4e987a9f41dab228924bda86e9
-
SHA256
91bbcd15503bc90d5b15e18ce3fcf5df8b2ba53708d2b03e993633f68e20ecaf
-
SHA512
a4bbb1d60be3b99b564a7b15d1a39421215a105174f50bcc84ca9c22eb4a977e6e97898098c2a720effb1e175af5130cc6b66537294cc7328a927fecbae4a128
-
SSDEEP
12288:fU5rCOTeid0POwjPNmhUg/nESdmT1xcTugL5DZu:fUQOJd05DYUgP8T1xW9Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1424 4D55.tmp 2008 4DD2.tmp 4632 4E7E.tmp 3844 4F1A.tmp 3188 4F97.tmp 3288 5023.tmp 1404 50A0.tmp 4976 510E.tmp 1976 518B.tmp 2424 5237.tmp 952 52C3.tmp 5044 5331.tmp 2980 53BD.tmp 2284 544A.tmp 3180 54C7.tmp 1048 5534.tmp 3000 55A2.tmp 1416 562E.tmp 1812 568C.tmp 1352 5719.tmp 3980 57A5.tmp 1980 5813.tmp 3436 5870.tmp 4936 590D.tmp 4496 59A9.tmp 3032 5A26.tmp 436 5A84.tmp 3632 5B01.tmp 4324 5B9D.tmp 2232 5C39.tmp 3364 5CC6.tmp 640 5D52.tmp 2008 5DDF.tmp 828 5E4C.tmp 468 5EBA.tmp 4532 5F27.tmp 3188 5F85.tmp 1804 5FE3.tmp 700 6031.tmp 3016 607F.tmp 1060 60CD.tmp 2860 612B.tmp 3488 6198.tmp 2524 6206.tmp 1512 6263.tmp 3028 62C1.tmp 3676 632E.tmp 3208 638C.tmp 1048 63EA.tmp 1684 6448.tmp 2024 64A5.tmp 2468 6503.tmp 2436 6551.tmp 4088 65BF.tmp 1352 662C.tmp 2596 667A.tmp 2328 66C8.tmp 4992 6736.tmp 1244 6793.tmp 3416 6801.tmp 2716 686E.tmp 3032 68CC.tmp 5052 692A.tmp 5004 6987.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1424 4692 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 89 PID 4692 wrote to memory of 1424 4692 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 89 PID 4692 wrote to memory of 1424 4692 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 89 PID 1424 wrote to memory of 2008 1424 4D55.tmp 90 PID 1424 wrote to memory of 2008 1424 4D55.tmp 90 PID 1424 wrote to memory of 2008 1424 4D55.tmp 90 PID 2008 wrote to memory of 4632 2008 4DD2.tmp 91 PID 2008 wrote to memory of 4632 2008 4DD2.tmp 91 PID 2008 wrote to memory of 4632 2008 4DD2.tmp 91 PID 4632 wrote to memory of 3844 4632 4E7E.tmp 92 PID 4632 wrote to memory of 3844 4632 4E7E.tmp 92 PID 4632 wrote to memory of 3844 4632 4E7E.tmp 92 PID 3844 wrote to memory of 3188 3844 4F1A.tmp 94 PID 3844 wrote to memory of 3188 3844 4F1A.tmp 94 PID 3844 wrote to memory of 3188 3844 4F1A.tmp 94 PID 3188 wrote to memory of 3288 3188 4F97.tmp 95 PID 3188 wrote to memory of 3288 3188 4F97.tmp 95 PID 3188 wrote to memory of 3288 3188 4F97.tmp 95 PID 3288 wrote to memory of 1404 3288 5023.tmp 97 PID 3288 wrote to memory of 1404 3288 5023.tmp 97 PID 3288 wrote to memory of 1404 3288 5023.tmp 97 PID 1404 wrote to memory of 4976 1404 50A0.tmp 98 PID 1404 wrote to memory of 4976 1404 50A0.tmp 98 PID 1404 wrote to memory of 4976 1404 50A0.tmp 98 PID 4976 wrote to memory of 1976 4976 510E.tmp 100 PID 4976 wrote to memory of 1976 4976 510E.tmp 100 PID 4976 wrote to memory of 1976 4976 510E.tmp 100 PID 1976 wrote to memory of 2424 1976 518B.tmp 101 PID 1976 wrote to memory of 2424 1976 518B.tmp 101 PID 1976 wrote to memory of 2424 1976 518B.tmp 101 PID 2424 wrote to memory of 952 2424 5237.tmp 102 PID 2424 wrote to memory of 952 2424 5237.tmp 102 PID 2424 wrote to memory of 952 2424 5237.tmp 102 PID 952 wrote to memory of 5044 952 52C3.tmp 103 PID 952 wrote to memory of 5044 952 52C3.tmp 103 PID 952 wrote to memory of 5044 952 52C3.tmp 103 PID 5044 wrote to memory of 2980 5044 5331.tmp 104 PID 5044 wrote to memory of 2980 5044 5331.tmp 104 PID 5044 wrote to memory of 2980 5044 5331.tmp 104 PID 2980 wrote to memory of 2284 2980 53BD.tmp 105 PID 2980 wrote to memory of 2284 2980 53BD.tmp 105 PID 2980 wrote to memory of 2284 2980 53BD.tmp 105 PID 2284 wrote to memory of 3180 2284 544A.tmp 106 PID 2284 wrote to memory of 3180 2284 544A.tmp 106 PID 2284 wrote to memory of 3180 2284 544A.tmp 106 PID 3180 wrote to memory of 1048 3180 54C7.tmp 107 PID 3180 wrote to memory of 1048 3180 54C7.tmp 107 PID 3180 wrote to memory of 1048 3180 54C7.tmp 107 PID 1048 wrote to memory of 3000 1048 5534.tmp 108 PID 1048 wrote to memory of 3000 1048 5534.tmp 108 PID 1048 wrote to memory of 3000 1048 5534.tmp 108 PID 3000 wrote to memory of 1416 3000 55A2.tmp 109 PID 3000 wrote to memory of 1416 3000 55A2.tmp 109 PID 3000 wrote to memory of 1416 3000 55A2.tmp 109 PID 1416 wrote to memory of 1812 1416 562E.tmp 110 PID 1416 wrote to memory of 1812 1416 562E.tmp 110 PID 1416 wrote to memory of 1812 1416 562E.tmp 110 PID 1812 wrote to memory of 1352 1812 568C.tmp 111 PID 1812 wrote to memory of 1352 1812 568C.tmp 111 PID 1812 wrote to memory of 1352 1812 568C.tmp 111 PID 1352 wrote to memory of 3980 1352 5719.tmp 112 PID 1352 wrote to memory of 3980 1352 5719.tmp 112 PID 1352 wrote to memory of 3980 1352 5719.tmp 112 PID 3980 wrote to memory of 1980 3980 57A5.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"23⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"24⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"25⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"26⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"27⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"28⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"29⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"30⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"31⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"32⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"33⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"34⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"35⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"36⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"37⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"38⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"39⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"40⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"41⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"42⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"43⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"44⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"45⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"46⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"47⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"48⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"49⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"50⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"51⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"52⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"53⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"54⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"55⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"56⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"57⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"58⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"59⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"60⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"61⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"62⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"63⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"64⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"65⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"66⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"67⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"68⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"69⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"70⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"71⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"72⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"73⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"74⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"75⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"76⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"77⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"78⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"79⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"80⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"81⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"82⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"83⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"84⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"85⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"86⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"87⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"88⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"89⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"90⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"91⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"92⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"94⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"95⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"96⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"97⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"98⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"99⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"100⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"101⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"102⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"103⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"104⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"105⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"106⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"107⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"108⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"109⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"110⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"111⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"112⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"113⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"114⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"115⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"116⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"117⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"118⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"119⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"120⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"121⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-