Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe
-
Size
527KB
-
MD5
665b96cf03583ceaa937586cb65fe391
-
SHA1
5d456277d4d09d85da162c6d2cbade2930cecd5c
-
SHA256
9a80cbd41f17d4148e8e4719ecd68708711cda53f070ede7f3df79e91488acc2
-
SHA512
7bf704070424396e29ec2d8c94525fee23a5873c69cecd15b3124c34ee1e693d51c907aba5f75e3d5b88d5dbfec1cb2469a42ca2dbf6c544641504d4355e9428
-
SSDEEP
12288:fU5rCOTeidWsbN/Sc274Q+qWLxuxkO7UPzDZu:fUQOJdWctoq0F7gzDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1504 76C6.tmp 368 7743.tmp 3556 77B0.tmp 3620 784D.tmp 5048 78AA.tmp 2184 78F9.tmp 4028 7966.tmp 5044 79C4.tmp 3412 7A31.tmp 3148 7A9E.tmp 820 7AFC.tmp 4224 7B4A.tmp 2864 7BB8.tmp 3092 7C44.tmp 2776 7CB2.tmp 1056 7D00.tmp 2376 7D5E.tmp 4552 7DDB.tmp 4824 7E29.tmp 756 7EA6.tmp 1396 7F13.tmp 4452 7F71.tmp 572 7FDE.tmp 3508 806B.tmp 2844 80C9.tmp 4108 8136.tmp 2764 8194.tmp 2400 81E2.tmp 5080 8240.tmp 3200 829D.tmp 4248 82FB.tmp 2712 8359.tmp 4928 83A7.tmp 1880 83F5.tmp 1012 8443.tmp 1504 8491.tmp 688 84DF.tmp 2948 853D.tmp 3252 85AB.tmp 1956 85F9.tmp 5048 8656.tmp 2168 86A5.tmp 2796 86F3.tmp 2892 8741.tmp 1096 878F.tmp 1840 87DD.tmp 1784 883B.tmp 1600 8899.tmp 4520 88F6.tmp 4736 8954.tmp 2696 89B2.tmp 3188 8A10.tmp 4920 8A5E.tmp 3304 8AAC.tmp 4788 8B0A.tmp 744 8B67.tmp 1312 8BC5.tmp 856 8C23.tmp 2872 8C90.tmp 2232 8CEE.tmp 2180 8D4C.tmp 2144 8DB9.tmp 3316 8E17.tmp 4860 8E84.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4492 wrote to memory of 1504 4492 2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe 87 PID 4492 wrote to memory of 1504 4492 2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe 87 PID 4492 wrote to memory of 1504 4492 2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe 87 PID 1504 wrote to memory of 368 1504 76C6.tmp 88 PID 1504 wrote to memory of 368 1504 76C6.tmp 88 PID 1504 wrote to memory of 368 1504 76C6.tmp 88 PID 368 wrote to memory of 3556 368 7743.tmp 89 PID 368 wrote to memory of 3556 368 7743.tmp 89 PID 368 wrote to memory of 3556 368 7743.tmp 89 PID 3556 wrote to memory of 3620 3556 77B0.tmp 90 PID 3556 wrote to memory of 3620 3556 77B0.tmp 90 PID 3556 wrote to memory of 3620 3556 77B0.tmp 90 PID 3620 wrote to memory of 5048 3620 784D.tmp 91 PID 3620 wrote to memory of 5048 3620 784D.tmp 91 PID 3620 wrote to memory of 5048 3620 784D.tmp 91 PID 5048 wrote to memory of 2184 5048 78AA.tmp 92 PID 5048 wrote to memory of 2184 5048 78AA.tmp 92 PID 5048 wrote to memory of 2184 5048 78AA.tmp 92 PID 2184 wrote to memory of 4028 2184 78F9.tmp 94 PID 2184 wrote to memory of 4028 2184 78F9.tmp 94 PID 2184 wrote to memory of 4028 2184 78F9.tmp 94 PID 4028 wrote to memory of 5044 4028 7966.tmp 96 PID 4028 wrote to memory of 5044 4028 7966.tmp 96 PID 4028 wrote to memory of 5044 4028 7966.tmp 96 PID 5044 wrote to memory of 3412 5044 79C4.tmp 98 PID 5044 wrote to memory of 3412 5044 79C4.tmp 98 PID 5044 wrote to memory of 3412 5044 79C4.tmp 98 PID 3412 wrote to memory of 3148 3412 7A31.tmp 99 PID 3412 wrote to memory of 3148 3412 7A31.tmp 99 PID 3412 wrote to memory of 3148 3412 7A31.tmp 99 PID 3148 wrote to memory of 820 3148 7A9E.tmp 100 PID 3148 wrote to memory of 820 3148 7A9E.tmp 100 PID 3148 wrote to memory of 820 3148 7A9E.tmp 100 PID 820 wrote to memory of 4224 820 7AFC.tmp 101 PID 820 wrote to memory of 4224 820 7AFC.tmp 101 PID 820 wrote to memory of 4224 820 7AFC.tmp 101 PID 4224 wrote to memory of 2864 4224 7B4A.tmp 102 PID 4224 wrote to memory of 2864 4224 7B4A.tmp 102 PID 4224 wrote to memory of 2864 4224 7B4A.tmp 102 PID 2864 wrote to memory of 3092 2864 7BB8.tmp 103 PID 2864 wrote to memory of 3092 2864 7BB8.tmp 103 PID 2864 wrote to memory of 3092 2864 7BB8.tmp 103 PID 3092 wrote to memory of 2776 3092 7C44.tmp 104 PID 3092 wrote to memory of 2776 3092 7C44.tmp 104 PID 3092 wrote to memory of 2776 3092 7C44.tmp 104 PID 2776 wrote to memory of 1056 2776 7CB2.tmp 105 PID 2776 wrote to memory of 1056 2776 7CB2.tmp 105 PID 2776 wrote to memory of 1056 2776 7CB2.tmp 105 PID 1056 wrote to memory of 2376 1056 7D00.tmp 106 PID 1056 wrote to memory of 2376 1056 7D00.tmp 106 PID 1056 wrote to memory of 2376 1056 7D00.tmp 106 PID 2376 wrote to memory of 4552 2376 7D5E.tmp 107 PID 2376 wrote to memory of 4552 2376 7D5E.tmp 107 PID 2376 wrote to memory of 4552 2376 7D5E.tmp 107 PID 4552 wrote to memory of 4824 4552 7DDB.tmp 108 PID 4552 wrote to memory of 4824 4552 7DDB.tmp 108 PID 4552 wrote to memory of 4824 4552 7DDB.tmp 108 PID 4824 wrote to memory of 756 4824 7E29.tmp 109 PID 4824 wrote to memory of 756 4824 7E29.tmp 109 PID 4824 wrote to memory of 756 4824 7E29.tmp 109 PID 756 wrote to memory of 1396 756 7EA6.tmp 110 PID 756 wrote to memory of 1396 756 7EA6.tmp 110 PID 756 wrote to memory of 1396 756 7EA6.tmp 110 PID 1396 wrote to memory of 4452 1396 7F13.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_665b96cf03583ceaa937586cb65fe391_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"23⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"24⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"25⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"26⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"27⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"28⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"29⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"30⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"31⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"32⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"33⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"34⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"35⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"36⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"37⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"38⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"39⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"40⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"41⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"42⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"43⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"44⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"45⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"46⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"47⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"48⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"49⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"50⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"51⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"52⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"53⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"54⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"55⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"56⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"57⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"58⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"59⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"60⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"61⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"62⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"63⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"64⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"65⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"67⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"68⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"69⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"70⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"71⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"72⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"73⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"74⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"75⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"76⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"78⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"79⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"80⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"81⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"82⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"83⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"84⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"85⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"86⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"87⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"88⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"89⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"90⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"91⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"92⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"93⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"94⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"95⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"96⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"97⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"98⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"99⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"100⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"101⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"102⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"103⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"104⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"105⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"106⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"107⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"108⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"109⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"110⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"111⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"112⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"113⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"114⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"115⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"116⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"117⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"118⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"119⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"120⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"121⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-