Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe
-
Size
486KB
-
MD5
cbbe125d06466b13cfcb44bed4321846
-
SHA1
020f6771994fc4af457612859ecfa5f70fd16440
-
SHA256
10da67ea58f4abd02bec20ce53e4138a0bb126f06198835f677e56bc716aec3d
-
SHA512
dd8af1b686ead384b0115cffd60d4218ec46608d84bd94d5f2f3fba97e21f6c47ed983f44047de46c6ed9d1a9984a8e13cedd934155d4094258da2d66536cc2c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7IQ2UiRb+Z9vvM6mYW6Hjga3APK4VZ87y4HHa:/U5rCOTeiDILZRb+XvMd6F3F4v64NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5112 4E4F.tmp 3128 4EBC.tmp 636 4F49.tmp 4056 4FE5.tmp 3692 5062.tmp 4772 50FE.tmp 2876 518B.tmp 2276 51F8.tmp 920 5266.tmp 4728 5302.tmp 3336 537F.tmp 4848 540B.tmp 4336 5469.tmp 2604 54C7.tmp 372 5534.tmp 4136 55D1.tmp 3928 564E.tmp 3340 56AB.tmp 4904 5786.tmp 2120 5803.tmp 1044 5861.tmp 3596 58FD.tmp 1688 594B.tmp 3140 59B9.tmp 2148 5A26.tmp 5048 5A84.tmp 1012 5AF1.tmp 3544 5B5E.tmp 4348 5BCC.tmp 2792 5C2A.tmp 620 5CA7.tmp 4432 5D72.tmp 840 5DEF.tmp 5104 5E4C.tmp 1864 5E9B.tmp 3060 5EE9.tmp 2580 5F37.tmp 960 5F95.tmp 3000 5FF2.tmp 4772 6050.tmp 5108 60AE.tmp 4736 611B.tmp 4836 6169.tmp 1296 61B7.tmp 4404 6215.tmp 4964 6273.tmp 548 62D1.tmp 1504 631F.tmp 3032 637D.tmp 832 63CB.tmp 1292 6419.tmp 836 6467.tmp 4692 64C5.tmp 1428 6532.tmp 2552 6590.tmp 3596 65EE.tmp 1688 665B.tmp 4464 66C8.tmp 3348 6716.tmp 3472 6774.tmp 1492 67C2.tmp 4008 683F.tmp 4000 68AD.tmp 4740 691A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 5112 1696 2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe 90 PID 1696 wrote to memory of 5112 1696 2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe 90 PID 1696 wrote to memory of 5112 1696 2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe 90 PID 5112 wrote to memory of 3128 5112 4E4F.tmp 91 PID 5112 wrote to memory of 3128 5112 4E4F.tmp 91 PID 5112 wrote to memory of 3128 5112 4E4F.tmp 91 PID 3128 wrote to memory of 636 3128 4EBC.tmp 92 PID 3128 wrote to memory of 636 3128 4EBC.tmp 92 PID 3128 wrote to memory of 636 3128 4EBC.tmp 92 PID 636 wrote to memory of 4056 636 4F49.tmp 93 PID 636 wrote to memory of 4056 636 4F49.tmp 93 PID 636 wrote to memory of 4056 636 4F49.tmp 93 PID 4056 wrote to memory of 3692 4056 4FE5.tmp 94 PID 4056 wrote to memory of 3692 4056 4FE5.tmp 94 PID 4056 wrote to memory of 3692 4056 4FE5.tmp 94 PID 3692 wrote to memory of 4772 3692 5062.tmp 95 PID 3692 wrote to memory of 4772 3692 5062.tmp 95 PID 3692 wrote to memory of 4772 3692 5062.tmp 95 PID 4772 wrote to memory of 2876 4772 50FE.tmp 98 PID 4772 wrote to memory of 2876 4772 50FE.tmp 98 PID 4772 wrote to memory of 2876 4772 50FE.tmp 98 PID 2876 wrote to memory of 2276 2876 518B.tmp 99 PID 2876 wrote to memory of 2276 2876 518B.tmp 99 PID 2876 wrote to memory of 2276 2876 518B.tmp 99 PID 2276 wrote to memory of 920 2276 51F8.tmp 101 PID 2276 wrote to memory of 920 2276 51F8.tmp 101 PID 2276 wrote to memory of 920 2276 51F8.tmp 101 PID 920 wrote to memory of 4728 920 5266.tmp 102 PID 920 wrote to memory of 4728 920 5266.tmp 102 PID 920 wrote to memory of 4728 920 5266.tmp 102 PID 4728 wrote to memory of 3336 4728 5302.tmp 103 PID 4728 wrote to memory of 3336 4728 5302.tmp 103 PID 4728 wrote to memory of 3336 4728 5302.tmp 103 PID 3336 wrote to memory of 4848 3336 537F.tmp 104 PID 3336 wrote to memory of 4848 3336 537F.tmp 104 PID 3336 wrote to memory of 4848 3336 537F.tmp 104 PID 4848 wrote to memory of 4336 4848 540B.tmp 105 PID 4848 wrote to memory of 4336 4848 540B.tmp 105 PID 4848 wrote to memory of 4336 4848 540B.tmp 105 PID 4336 wrote to memory of 2604 4336 5469.tmp 106 PID 4336 wrote to memory of 2604 4336 5469.tmp 106 PID 4336 wrote to memory of 2604 4336 5469.tmp 106 PID 2604 wrote to memory of 372 2604 54C7.tmp 107 PID 2604 wrote to memory of 372 2604 54C7.tmp 107 PID 2604 wrote to memory of 372 2604 54C7.tmp 107 PID 372 wrote to memory of 4136 372 5534.tmp 108 PID 372 wrote to memory of 4136 372 5534.tmp 108 PID 372 wrote to memory of 4136 372 5534.tmp 108 PID 4136 wrote to memory of 3928 4136 55D1.tmp 109 PID 4136 wrote to memory of 3928 4136 55D1.tmp 109 PID 4136 wrote to memory of 3928 4136 55D1.tmp 109 PID 3928 wrote to memory of 3340 3928 564E.tmp 110 PID 3928 wrote to memory of 3340 3928 564E.tmp 110 PID 3928 wrote to memory of 3340 3928 564E.tmp 110 PID 3340 wrote to memory of 4904 3340 56AB.tmp 111 PID 3340 wrote to memory of 4904 3340 56AB.tmp 111 PID 3340 wrote to memory of 4904 3340 56AB.tmp 111 PID 4904 wrote to memory of 2120 4904 5786.tmp 112 PID 4904 wrote to memory of 2120 4904 5786.tmp 112 PID 4904 wrote to memory of 2120 4904 5786.tmp 112 PID 2120 wrote to memory of 1044 2120 5803.tmp 113 PID 2120 wrote to memory of 1044 2120 5803.tmp 113 PID 2120 wrote to memory of 1044 2120 5803.tmp 113 PID 1044 wrote to memory of 3596 1044 5861.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_cbbe125d06466b13cfcb44bed4321846_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"23⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"24⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"25⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"26⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"27⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"28⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"29⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"30⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"31⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"32⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"33⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"34⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"35⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"36⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"37⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"38⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"39⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"40⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"41⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"42⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"43⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"44⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"45⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"46⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"47⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"48⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"49⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"50⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"51⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"52⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"53⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"54⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"55⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"56⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"57⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"58⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"59⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"60⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"61⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"62⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"63⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"64⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"65⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"66⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"67⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"68⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"70⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"71⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"72⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"73⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"74⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"75⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"76⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"77⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"78⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"79⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"80⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"81⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"82⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"83⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"84⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"85⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"86⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"87⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"88⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"89⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"90⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"91⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"92⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"93⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"94⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"95⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"96⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"97⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"98⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"99⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"100⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"102⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"103⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"104⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"105⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"106⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"107⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"108⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"109⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"110⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"111⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"112⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"113⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"114⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"115⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"116⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"117⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"118⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"119⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"120⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"121⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-