Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe
-
Size
530KB
-
MD5
077f4e12c0c261773153be3b75c87a0e
-
SHA1
ec60e2f5e7c198d4431e51951a56a76d8b652830
-
SHA256
c06987673af26abc9c4ef59dad944f7ba9f64ac7a130c179cdfd29de8b6cca3e
-
SHA512
225b4cd7aca226a4c0e124b91a939d36d6bcc650fefd0ecb0c15451b55697f14ee9ac26c2e8578c6ad35efd0dec225eb72f1bc06dfca0b731d02f525f6e06d6a
-
SSDEEP
12288:AU5rCOTeio9dfVCd617w2T+z2f+sagNZulFVg0M1:AUQOJo91Vf17F+lMNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1784 4D07.tmp 220 4D93.tmp 3744 4E20.tmp 2492 4EDB.tmp 4992 4F58.tmp 2084 4FD5.tmp 2268 5052.tmp 4248 50EF.tmp 1736 517B.tmp 2424 51E9.tmp 1900 5266.tmp 4604 52D3.tmp 2744 536F.tmp 3696 53FC.tmp 4448 5469.tmp 4032 54D7.tmp 2880 5573.tmp 1376 560F.tmp 872 566D.tmp 2112 56EA.tmp 1764 5767.tmp 3668 57C5.tmp 2780 5832.tmp 3136 5890.tmp 2932 591C.tmp 2976 597A.tmp 464 59F7.tmp 4112 5A84.tmp 2548 5AE1.tmp 2860 5B7E.tmp 1880 5BEB.tmp 1708 5C39.tmp 4980 5C97.tmp 2032 5CF5.tmp 1232 5D33.tmp 1608 5D81.tmp 2304 5DCF.tmp 4632 5E1E.tmp 4200 5E7B.tmp 4172 5ED9.tmp 1812 5F37.tmp 4736 5F95.tmp 2892 5FF2.tmp 3764 6040.tmp 3164 608F.tmp 1480 60DD.tmp 1132 612B.tmp 2928 6179.tmp 1360 61D7.tmp 1264 6234.tmp 3744 6292.tmp 928 6300.tmp 1996 636D.tmp 3516 63CB.tmp 2084 6419.tmp 3564 6477.tmp 4168 64D4.tmp 4248 6532.tmp 1980 6580.tmp 4660 65DE.tmp 508 662C.tmp 3532 668A.tmp 3776 66E8.tmp 1372 6736.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 1784 4016 2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe 83 PID 4016 wrote to memory of 1784 4016 2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe 83 PID 4016 wrote to memory of 1784 4016 2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe 83 PID 1784 wrote to memory of 220 1784 4D07.tmp 86 PID 1784 wrote to memory of 220 1784 4D07.tmp 86 PID 1784 wrote to memory of 220 1784 4D07.tmp 86 PID 220 wrote to memory of 3744 220 4D93.tmp 88 PID 220 wrote to memory of 3744 220 4D93.tmp 88 PID 220 wrote to memory of 3744 220 4D93.tmp 88 PID 3744 wrote to memory of 2492 3744 4E20.tmp 89 PID 3744 wrote to memory of 2492 3744 4E20.tmp 89 PID 3744 wrote to memory of 2492 3744 4E20.tmp 89 PID 2492 wrote to memory of 4992 2492 4EDB.tmp 90 PID 2492 wrote to memory of 4992 2492 4EDB.tmp 90 PID 2492 wrote to memory of 4992 2492 4EDB.tmp 90 PID 4992 wrote to memory of 2084 4992 4F58.tmp 91 PID 4992 wrote to memory of 2084 4992 4F58.tmp 91 PID 4992 wrote to memory of 2084 4992 4F58.tmp 91 PID 2084 wrote to memory of 2268 2084 4FD5.tmp 92 PID 2084 wrote to memory of 2268 2084 4FD5.tmp 92 PID 2084 wrote to memory of 2268 2084 4FD5.tmp 92 PID 2268 wrote to memory of 4248 2268 5052.tmp 93 PID 2268 wrote to memory of 4248 2268 5052.tmp 93 PID 2268 wrote to memory of 4248 2268 5052.tmp 93 PID 4248 wrote to memory of 1736 4248 50EF.tmp 94 PID 4248 wrote to memory of 1736 4248 50EF.tmp 94 PID 4248 wrote to memory of 1736 4248 50EF.tmp 94 PID 1736 wrote to memory of 2424 1736 517B.tmp 95 PID 1736 wrote to memory of 2424 1736 517B.tmp 95 PID 1736 wrote to memory of 2424 1736 517B.tmp 95 PID 2424 wrote to memory of 1900 2424 51E9.tmp 96 PID 2424 wrote to memory of 1900 2424 51E9.tmp 96 PID 2424 wrote to memory of 1900 2424 51E9.tmp 96 PID 1900 wrote to memory of 4604 1900 5266.tmp 97 PID 1900 wrote to memory of 4604 1900 5266.tmp 97 PID 1900 wrote to memory of 4604 1900 5266.tmp 97 PID 4604 wrote to memory of 2744 4604 52D3.tmp 98 PID 4604 wrote to memory of 2744 4604 52D3.tmp 98 PID 4604 wrote to memory of 2744 4604 52D3.tmp 98 PID 2744 wrote to memory of 3696 2744 536F.tmp 99 PID 2744 wrote to memory of 3696 2744 536F.tmp 99 PID 2744 wrote to memory of 3696 2744 536F.tmp 99 PID 3696 wrote to memory of 4448 3696 53FC.tmp 100 PID 3696 wrote to memory of 4448 3696 53FC.tmp 100 PID 3696 wrote to memory of 4448 3696 53FC.tmp 100 PID 4448 wrote to memory of 4032 4448 5469.tmp 101 PID 4448 wrote to memory of 4032 4448 5469.tmp 101 PID 4448 wrote to memory of 4032 4448 5469.tmp 101 PID 4032 wrote to memory of 2880 4032 54D7.tmp 102 PID 4032 wrote to memory of 2880 4032 54D7.tmp 102 PID 4032 wrote to memory of 2880 4032 54D7.tmp 102 PID 2880 wrote to memory of 1376 2880 5573.tmp 103 PID 2880 wrote to memory of 1376 2880 5573.tmp 103 PID 2880 wrote to memory of 1376 2880 5573.tmp 103 PID 1376 wrote to memory of 872 1376 560F.tmp 104 PID 1376 wrote to memory of 872 1376 560F.tmp 104 PID 1376 wrote to memory of 872 1376 560F.tmp 104 PID 872 wrote to memory of 2112 872 566D.tmp 105 PID 872 wrote to memory of 2112 872 566D.tmp 105 PID 872 wrote to memory of 2112 872 566D.tmp 105 PID 2112 wrote to memory of 1764 2112 56EA.tmp 106 PID 2112 wrote to memory of 1764 2112 56EA.tmp 106 PID 2112 wrote to memory of 1764 2112 56EA.tmp 106 PID 1764 wrote to memory of 3668 1764 5767.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_077f4e12c0c261773153be3b75c87a0e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"23⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"24⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"25⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"26⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"27⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"28⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"29⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"30⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"31⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"32⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"33⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"34⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"35⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"36⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"37⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"38⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"39⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"40⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"41⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"42⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"43⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"44⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"45⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"46⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"47⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"48⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"49⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"50⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"51⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"52⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"53⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"54⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"55⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"56⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"57⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"58⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"59⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"60⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"61⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"62⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"63⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"64⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"65⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"66⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"67⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"68⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"69⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"70⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"71⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"72⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"73⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"74⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"75⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"77⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"78⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"79⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"80⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"81⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"82⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"83⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"84⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"85⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"86⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"87⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"88⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"89⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"90⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"91⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"92⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"93⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"94⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"95⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"96⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"97⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"98⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"99⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"100⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"101⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"102⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"103⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"104⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"105⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"106⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"107⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"108⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"109⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"110⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"111⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"112⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"113⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"114⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"116⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"117⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"118⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"119⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"121⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"122⤵PID:4036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-