Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 23:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe
-
Size
487KB
-
MD5
10a4310f3567c11d80619ac2e553960c
-
SHA1
b55f6af03db669279f98112d1639a32e7fba78f0
-
SHA256
076af2e5e014acebfb5956877aff967cb0d9712ab433c2eb20caf6a0ca96de51
-
SHA512
922da7189d0c51b9e710c7c181d8c660f8eb39939091daf240278be8087d0b4aa132aaab6feec43971608d8e2a5a46ceeedc426f29ca1db90b8c4dd373ca25c2
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxqmCT8nuwbR/ZL+EFrUuzpw0FjO3D4TsH3rZ:yU5rCOTeiN8l8jth2WNRH4bZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1660 4F0A.tmp 1416 4FC6.tmp 1652 5033.tmp 1356 50CF.tmp 2512 515C.tmp 2160 51D9.tmp 3252 5266.tmp 1732 52C3.tmp 5056 5340.tmp 2416 53CD.tmp 4996 5469.tmp 2880 54D7.tmp 2480 5573.tmp 3628 55E0.tmp 1032 566D.tmp 2040 56F9.tmp 2224 5757.tmp 4068 57D4.tmp 556 5861.tmp 5028 58CE.tmp 4712 593C.tmp 1168 59B9.tmp 4460 5A55.tmp 2288 5AB3.tmp 2724 5B30.tmp 1756 5BCC.tmp 3588 5C1A.tmp 2804 5C97.tmp 1196 5D43.tmp 4440 5DA1.tmp 4924 5E1E.tmp 1544 5E8B.tmp 4480 5EF8.tmp 2112 5F56.tmp 4308 5F95.tmp 2852 5FE3.tmp 1684 6040.tmp 4364 608F.tmp 3816 60DD.tmp 4464 613A.tmp 2432 6198.tmp 2300 6215.tmp 4100 6273.tmp 4548 62D1.tmp 1360 631F.tmp 4696 636D.tmp 2784 63BB.tmp 1444 6409.tmp 1408 6457.tmp 4452 64B5.tmp 1204 6513.tmp 2880 6571.tmp 3064 65CE.tmp 3860 663C.tmp 2340 668A.tmp 2556 66F7.tmp 1872 6765.tmp 4564 67C2.tmp 4348 6810.tmp 540 686E.tmp 3748 68CC.tmp 2908 692A.tmp 2124 6987.tmp 5000 69E5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 1660 5012 2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe 83 PID 5012 wrote to memory of 1660 5012 2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe 83 PID 5012 wrote to memory of 1660 5012 2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe 83 PID 1660 wrote to memory of 1416 1660 4F0A.tmp 84 PID 1660 wrote to memory of 1416 1660 4F0A.tmp 84 PID 1660 wrote to memory of 1416 1660 4F0A.tmp 84 PID 1416 wrote to memory of 1652 1416 4FC6.tmp 85 PID 1416 wrote to memory of 1652 1416 4FC6.tmp 85 PID 1416 wrote to memory of 1652 1416 4FC6.tmp 85 PID 1652 wrote to memory of 1356 1652 5033.tmp 87 PID 1652 wrote to memory of 1356 1652 5033.tmp 87 PID 1652 wrote to memory of 1356 1652 5033.tmp 87 PID 1356 wrote to memory of 2512 1356 50CF.tmp 89 PID 1356 wrote to memory of 2512 1356 50CF.tmp 89 PID 1356 wrote to memory of 2512 1356 50CF.tmp 89 PID 2512 wrote to memory of 2160 2512 515C.tmp 90 PID 2512 wrote to memory of 2160 2512 515C.tmp 90 PID 2512 wrote to memory of 2160 2512 515C.tmp 90 PID 2160 wrote to memory of 3252 2160 51D9.tmp 92 PID 2160 wrote to memory of 3252 2160 51D9.tmp 92 PID 2160 wrote to memory of 3252 2160 51D9.tmp 92 PID 3252 wrote to memory of 1732 3252 5266.tmp 93 PID 3252 wrote to memory of 1732 3252 5266.tmp 93 PID 3252 wrote to memory of 1732 3252 5266.tmp 93 PID 1732 wrote to memory of 5056 1732 52C3.tmp 94 PID 1732 wrote to memory of 5056 1732 52C3.tmp 94 PID 1732 wrote to memory of 5056 1732 52C3.tmp 94 PID 5056 wrote to memory of 2416 5056 5340.tmp 95 PID 5056 wrote to memory of 2416 5056 5340.tmp 95 PID 5056 wrote to memory of 2416 5056 5340.tmp 95 PID 2416 wrote to memory of 4996 2416 53CD.tmp 96 PID 2416 wrote to memory of 4996 2416 53CD.tmp 96 PID 2416 wrote to memory of 4996 2416 53CD.tmp 96 PID 4996 wrote to memory of 2880 4996 5469.tmp 97 PID 4996 wrote to memory of 2880 4996 5469.tmp 97 PID 4996 wrote to memory of 2880 4996 5469.tmp 97 PID 2880 wrote to memory of 2480 2880 54D7.tmp 98 PID 2880 wrote to memory of 2480 2880 54D7.tmp 98 PID 2880 wrote to memory of 2480 2880 54D7.tmp 98 PID 2480 wrote to memory of 3628 2480 5573.tmp 99 PID 2480 wrote to memory of 3628 2480 5573.tmp 99 PID 2480 wrote to memory of 3628 2480 5573.tmp 99 PID 3628 wrote to memory of 1032 3628 55E0.tmp 100 PID 3628 wrote to memory of 1032 3628 55E0.tmp 100 PID 3628 wrote to memory of 1032 3628 55E0.tmp 100 PID 1032 wrote to memory of 2040 1032 566D.tmp 101 PID 1032 wrote to memory of 2040 1032 566D.tmp 101 PID 1032 wrote to memory of 2040 1032 566D.tmp 101 PID 2040 wrote to memory of 2224 2040 56F9.tmp 102 PID 2040 wrote to memory of 2224 2040 56F9.tmp 102 PID 2040 wrote to memory of 2224 2040 56F9.tmp 102 PID 2224 wrote to memory of 4068 2224 5757.tmp 103 PID 2224 wrote to memory of 4068 2224 5757.tmp 103 PID 2224 wrote to memory of 4068 2224 5757.tmp 103 PID 4068 wrote to memory of 556 4068 57D4.tmp 104 PID 4068 wrote to memory of 556 4068 57D4.tmp 104 PID 4068 wrote to memory of 556 4068 57D4.tmp 104 PID 556 wrote to memory of 5028 556 5861.tmp 105 PID 556 wrote to memory of 5028 556 5861.tmp 105 PID 556 wrote to memory of 5028 556 5861.tmp 105 PID 5028 wrote to memory of 4712 5028 58CE.tmp 106 PID 5028 wrote to memory of 4712 5028 58CE.tmp 106 PID 5028 wrote to memory of 4712 5028 58CE.tmp 106 PID 4712 wrote to memory of 1168 4712 593C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-06_10a4310f3567c11d80619ac2e553960c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"23⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"24⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"25⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"26⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"27⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"28⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"29⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"30⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"31⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"32⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"33⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"34⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"35⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"36⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"37⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"38⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"39⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"40⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"41⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"42⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"43⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"44⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"45⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"46⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"47⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"48⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"49⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"50⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"51⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"52⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"53⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"54⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"55⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"56⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"57⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"58⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"59⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"60⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"61⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"62⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"63⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"64⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"65⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"66⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"67⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"68⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"69⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"70⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"71⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"72⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"73⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"74⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"75⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"76⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"77⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"78⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"79⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"80⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"81⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"82⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"83⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"84⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"85⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"86⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"87⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"88⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"90⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"91⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"92⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"93⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"94⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"95⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"96⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"97⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"98⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"99⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"100⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"101⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"102⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"103⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"104⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"105⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"106⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"107⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"108⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"109⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"110⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"111⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"112⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"113⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"114⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"115⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"116⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"117⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"118⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"120⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"121⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"122⤵PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-