Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
-
Size
486KB
-
MD5
c5ac88fe69ea4e952c1ee58474a70f7e
-
SHA1
f2105b2a5f549eeff15dce00ddf7b0191973afb8
-
SHA256
7a496772d14dea7da94f98ea3f0475e14e13928b518e8149d0611317340600bf
-
SHA512
c5283fd79527003ff8a0de71bddbb988b15c92c4ac7f458e039b0e30d262377935a6c9ce0e21a737b3e2c865ee5729e249f0dc3e4d9fe36adcf3e69dd9a11b88
-
SSDEEP
12288:UU5rCOTeiDa8slT2C7cZWaK20rN67uY5qEhNZ:UUQOJDfs94ZWKiNLaZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2780 468E.tmp 1476 474A.tmp 3920 47E6.tmp 4860 4863.tmp 4576 48FF.tmp 1228 498C.tmp 4140 4A28.tmp 436 4AA5.tmp 1056 4B13.tmp 3628 4B80.tmp 2824 4C1C.tmp 4632 4CB8.tmp 4272 4D26.tmp 3184 4DA3.tmp 4540 4E3F.tmp 1848 4EDB.tmp 1824 4F78.tmp 1280 4FE5.tmp 3188 5062.tmp 448 50DF.tmp 3568 514C.tmp 764 51E9.tmp 1804 5266.tmp 1872 52C3.tmp 4368 5331.tmp 1012 539E.tmp 3532 541B.tmp 2836 5488.tmp 5076 5515.tmp 2440 55A2.tmp 1444 561F.tmp 3852 56AB.tmp 4828 5748.tmp 3672 57B5.tmp 2772 5813.tmp 2848 5870.tmp 4732 58CE.tmp 2780 592C.tmp 4644 598A.tmp 5008 59E7.tmp 1476 5A45.tmp 5004 5AB3.tmp 3444 5B10.tmp 2184 5B6E.tmp 2996 5BDB.tmp 4880 5C39.tmp 1452 5C87.tmp 3676 5CD5.tmp 1708 5D43.tmp 3460 5DB0.tmp 2776 5E0E.tmp 4352 5E5C.tmp 3704 5EBA.tmp 4640 5F18.tmp 468 5F85.tmp 4728 5FF2.tmp 4708 6060.tmp 4632 60BD.tmp 4248 610C.tmp 2432 6169.tmp 2044 61C7.tmp 4648 6215.tmp 704 6263.tmp 1676 62C1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2780 4780 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 85 PID 4780 wrote to memory of 2780 4780 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 85 PID 4780 wrote to memory of 2780 4780 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 85 PID 2780 wrote to memory of 1476 2780 468E.tmp 87 PID 2780 wrote to memory of 1476 2780 468E.tmp 87 PID 2780 wrote to memory of 1476 2780 468E.tmp 87 PID 1476 wrote to memory of 3920 1476 474A.tmp 88 PID 1476 wrote to memory of 3920 1476 474A.tmp 88 PID 1476 wrote to memory of 3920 1476 474A.tmp 88 PID 3920 wrote to memory of 4860 3920 47E6.tmp 90 PID 3920 wrote to memory of 4860 3920 47E6.tmp 90 PID 3920 wrote to memory of 4860 3920 47E6.tmp 90 PID 4860 wrote to memory of 4576 4860 4863.tmp 91 PID 4860 wrote to memory of 4576 4860 4863.tmp 91 PID 4860 wrote to memory of 4576 4860 4863.tmp 91 PID 4576 wrote to memory of 1228 4576 48FF.tmp 92 PID 4576 wrote to memory of 1228 4576 48FF.tmp 92 PID 4576 wrote to memory of 1228 4576 48FF.tmp 92 PID 1228 wrote to memory of 4140 1228 498C.tmp 93 PID 1228 wrote to memory of 4140 1228 498C.tmp 93 PID 1228 wrote to memory of 4140 1228 498C.tmp 93 PID 4140 wrote to memory of 436 4140 4A28.tmp 94 PID 4140 wrote to memory of 436 4140 4A28.tmp 94 PID 4140 wrote to memory of 436 4140 4A28.tmp 94 PID 436 wrote to memory of 1056 436 4AA5.tmp 95 PID 436 wrote to memory of 1056 436 4AA5.tmp 95 PID 436 wrote to memory of 1056 436 4AA5.tmp 95 PID 1056 wrote to memory of 3628 1056 4B13.tmp 96 PID 1056 wrote to memory of 3628 1056 4B13.tmp 96 PID 1056 wrote to memory of 3628 1056 4B13.tmp 96 PID 3628 wrote to memory of 2824 3628 4B80.tmp 97 PID 3628 wrote to memory of 2824 3628 4B80.tmp 97 PID 3628 wrote to memory of 2824 3628 4B80.tmp 97 PID 2824 wrote to memory of 4632 2824 4C1C.tmp 99 PID 2824 wrote to memory of 4632 2824 4C1C.tmp 99 PID 2824 wrote to memory of 4632 2824 4C1C.tmp 99 PID 4632 wrote to memory of 4272 4632 4CB8.tmp 100 PID 4632 wrote to memory of 4272 4632 4CB8.tmp 100 PID 4632 wrote to memory of 4272 4632 4CB8.tmp 100 PID 4272 wrote to memory of 3184 4272 4D26.tmp 101 PID 4272 wrote to memory of 3184 4272 4D26.tmp 101 PID 4272 wrote to memory of 3184 4272 4D26.tmp 101 PID 3184 wrote to memory of 4540 3184 4DA3.tmp 102 PID 3184 wrote to memory of 4540 3184 4DA3.tmp 102 PID 3184 wrote to memory of 4540 3184 4DA3.tmp 102 PID 4540 wrote to memory of 1848 4540 4E3F.tmp 103 PID 4540 wrote to memory of 1848 4540 4E3F.tmp 103 PID 4540 wrote to memory of 1848 4540 4E3F.tmp 103 PID 1848 wrote to memory of 1824 1848 4EDB.tmp 104 PID 1848 wrote to memory of 1824 1848 4EDB.tmp 104 PID 1848 wrote to memory of 1824 1848 4EDB.tmp 104 PID 1824 wrote to memory of 1280 1824 4F78.tmp 105 PID 1824 wrote to memory of 1280 1824 4F78.tmp 105 PID 1824 wrote to memory of 1280 1824 4F78.tmp 105 PID 1280 wrote to memory of 3188 1280 4FE5.tmp 106 PID 1280 wrote to memory of 3188 1280 4FE5.tmp 106 PID 1280 wrote to memory of 3188 1280 4FE5.tmp 106 PID 3188 wrote to memory of 448 3188 5062.tmp 109 PID 3188 wrote to memory of 448 3188 5062.tmp 109 PID 3188 wrote to memory of 448 3188 5062.tmp 109 PID 448 wrote to memory of 3568 448 50DF.tmp 110 PID 448 wrote to memory of 3568 448 50DF.tmp 110 PID 448 wrote to memory of 3568 448 50DF.tmp 110 PID 3568 wrote to memory of 764 3568 514C.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"23⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"24⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"25⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"26⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"27⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"28⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"29⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"30⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"31⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"32⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"33⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"34⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"35⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"36⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"37⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"38⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"39⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"40⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"41⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"42⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"43⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"44⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"45⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"46⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"47⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"48⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"49⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"50⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"51⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"52⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"53⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"54⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"55⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"56⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"57⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"58⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"59⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"60⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"61⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"62⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"63⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"64⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"65⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"66⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"67⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"68⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"69⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"70⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"71⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"72⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"73⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"74⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"75⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"76⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"77⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"78⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"79⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"80⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"81⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"82⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"83⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"84⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"85⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"86⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"87⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"88⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"89⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"90⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"91⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"92⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"93⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"94⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"95⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"96⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"97⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"98⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"99⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"100⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"101⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"102⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"103⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"104⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"105⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"106⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"107⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"108⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"109⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"110⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"111⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"112⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"113⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"114⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"115⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"116⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"117⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"118⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"119⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"120⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"121⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-