Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe
-
Size
488KB
-
MD5
07b748a13c2b6ede2a3f65c8b108b90a
-
SHA1
e8fb88a265cca82c30a9421815b10fe353a48f15
-
SHA256
524b3c443df02da5d2e803ec8d3cbde973908341ed6436689a87992e7da8d07a
-
SHA512
935b613a3a42f0a54252ef63145f52201fb08e7cbfa181f0994b11399291ca8894b5ed5277224af5119014f8c61cb9466e87b203c025f4696adc1252a8c4f0ad
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7e33k5JqD0ygLIkYkQUoJ+cah8jwyG6o9GZTb:/U5rCOTeiDeUqDr1kVbh8LG0tPNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
F5AA.tmpF627.tmpF6B4.tmpF721.tmpF7AE.tmpF82B.tmpF898.tmpF906.tmpF973.tmpF9E1.tmpFA5E.tmpFAAC.tmpFB09.tmpFB67.tmpFBD5.tmpFC42.tmpFCAF.tmpFD0D.tmpFD8A.tmpFDE8.tmpFE46.tmpFEC3.tmpFF4F.tmpFFAD.tmpB.tmp88.tmpE5.tmp162.tmp1D0.tmp23D.tmp2AB.tmp318.tmp366.tmp3B4.tmp422.tmp47F.tmp4DD.tmp53B.tmp599.tmp5F6.tmp654.tmp6A2.tmp6F0.tmp73E.tmp78D.tmp7DB.tmp829.tmp877.tmp8D5.tmp923.tmp981.tmp9DE.tmpA3C.tmpA8A.tmpAE8.tmpB46.tmpBA3.tmpC01.tmpC5F.tmpCBD.tmpD1A.tmpD78.tmpDC6.tmpE24.tmppid process 856 F5AA.tmp 1924 F627.tmp 4068 F6B4.tmp 2188 F721.tmp 3364 F7AE.tmp 2528 F82B.tmp 1060 F898.tmp 4424 F906.tmp 2424 F973.tmp 3932 F9E1.tmp 3832 FA5E.tmp 3272 FAAC.tmp 3712 FB09.tmp 4932 FB67.tmp 1264 FBD5.tmp 4396 FC42.tmp 2468 FCAF.tmp 60 FD0D.tmp 4812 FD8A.tmp 4596 FDE8.tmp 2904 FE46.tmp 2184 FEC3.tmp 1936 FF4F.tmp 4532 FFAD.tmp 3052 B.tmp 384 88.tmp 324 E5.tmp 3804 162.tmp 4392 1D0.tmp 4108 23D.tmp 912 2AB.tmp 4980 318.tmp 1060 366.tmp 4440 3B4.tmp 4640 422.tmp 3580 47F.tmp 1736 4DD.tmp 1548 53B.tmp 232 599.tmp 1996 5F6.tmp 4844 654.tmp 3492 6A2.tmp 3224 6F0.tmp 460 73E.tmp 984 78D.tmp 3852 7DB.tmp 1936 829.tmp 2608 877.tmp 4532 8D5.tmp 1680 923.tmp 3848 981.tmp 3212 9DE.tmp 1168 A3C.tmp 3140 A8A.tmp 2268 AE8.tmp 4108 B46.tmp 4436 BA3.tmp 1128 C01.tmp 400 C5F.tmp 1472 CBD.tmp 2844 D1A.tmp 2452 D78.tmp 2080 DC6.tmp 3284 E24.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exeF5AA.tmpF627.tmpF6B4.tmpF721.tmpF7AE.tmpF82B.tmpF898.tmpF906.tmpF973.tmpF9E1.tmpFA5E.tmpFAAC.tmpFB09.tmpFB67.tmpFBD5.tmpFC42.tmpFCAF.tmpFD0D.tmpFD8A.tmpFDE8.tmpFE46.tmpdescription pid process target process PID 3128 wrote to memory of 856 3128 2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe F5AA.tmp PID 3128 wrote to memory of 856 3128 2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe F5AA.tmp PID 3128 wrote to memory of 856 3128 2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe F5AA.tmp PID 856 wrote to memory of 1924 856 F5AA.tmp F627.tmp PID 856 wrote to memory of 1924 856 F5AA.tmp F627.tmp PID 856 wrote to memory of 1924 856 F5AA.tmp F627.tmp PID 1924 wrote to memory of 4068 1924 F627.tmp F6B4.tmp PID 1924 wrote to memory of 4068 1924 F627.tmp F6B4.tmp PID 1924 wrote to memory of 4068 1924 F627.tmp F6B4.tmp PID 4068 wrote to memory of 2188 4068 F6B4.tmp F721.tmp PID 4068 wrote to memory of 2188 4068 F6B4.tmp F721.tmp PID 4068 wrote to memory of 2188 4068 F6B4.tmp F721.tmp PID 2188 wrote to memory of 3364 2188 F721.tmp F7AE.tmp PID 2188 wrote to memory of 3364 2188 F721.tmp F7AE.tmp PID 2188 wrote to memory of 3364 2188 F721.tmp F7AE.tmp PID 3364 wrote to memory of 2528 3364 F7AE.tmp F82B.tmp PID 3364 wrote to memory of 2528 3364 F7AE.tmp F82B.tmp PID 3364 wrote to memory of 2528 3364 F7AE.tmp F82B.tmp PID 2528 wrote to memory of 1060 2528 F82B.tmp F898.tmp PID 2528 wrote to memory of 1060 2528 F82B.tmp F898.tmp PID 2528 wrote to memory of 1060 2528 F82B.tmp F898.tmp PID 1060 wrote to memory of 4424 1060 F898.tmp F906.tmp PID 1060 wrote to memory of 4424 1060 F898.tmp F906.tmp PID 1060 wrote to memory of 4424 1060 F898.tmp F906.tmp PID 4424 wrote to memory of 2424 4424 F906.tmp F973.tmp PID 4424 wrote to memory of 2424 4424 F906.tmp F973.tmp PID 4424 wrote to memory of 2424 4424 F906.tmp F973.tmp PID 2424 wrote to memory of 3932 2424 F973.tmp F9E1.tmp PID 2424 wrote to memory of 3932 2424 F973.tmp F9E1.tmp PID 2424 wrote to memory of 3932 2424 F973.tmp F9E1.tmp PID 3932 wrote to memory of 3832 3932 F9E1.tmp FA5E.tmp PID 3932 wrote to memory of 3832 3932 F9E1.tmp FA5E.tmp PID 3932 wrote to memory of 3832 3932 F9E1.tmp FA5E.tmp PID 3832 wrote to memory of 3272 3832 FA5E.tmp FAAC.tmp PID 3832 wrote to memory of 3272 3832 FA5E.tmp FAAC.tmp PID 3832 wrote to memory of 3272 3832 FA5E.tmp FAAC.tmp PID 3272 wrote to memory of 3712 3272 FAAC.tmp FB09.tmp PID 3272 wrote to memory of 3712 3272 FAAC.tmp FB09.tmp PID 3272 wrote to memory of 3712 3272 FAAC.tmp FB09.tmp PID 3712 wrote to memory of 4932 3712 FB09.tmp FB67.tmp PID 3712 wrote to memory of 4932 3712 FB09.tmp FB67.tmp PID 3712 wrote to memory of 4932 3712 FB09.tmp FB67.tmp PID 4932 wrote to memory of 1264 4932 FB67.tmp FBD5.tmp PID 4932 wrote to memory of 1264 4932 FB67.tmp FBD5.tmp PID 4932 wrote to memory of 1264 4932 FB67.tmp FBD5.tmp PID 1264 wrote to memory of 4396 1264 FBD5.tmp FC42.tmp PID 1264 wrote to memory of 4396 1264 FBD5.tmp FC42.tmp PID 1264 wrote to memory of 4396 1264 FBD5.tmp FC42.tmp PID 4396 wrote to memory of 2468 4396 FC42.tmp FCAF.tmp PID 4396 wrote to memory of 2468 4396 FC42.tmp FCAF.tmp PID 4396 wrote to memory of 2468 4396 FC42.tmp FCAF.tmp PID 2468 wrote to memory of 60 2468 FCAF.tmp FD0D.tmp PID 2468 wrote to memory of 60 2468 FCAF.tmp FD0D.tmp PID 2468 wrote to memory of 60 2468 FCAF.tmp FD0D.tmp PID 60 wrote to memory of 4812 60 FD0D.tmp FD8A.tmp PID 60 wrote to memory of 4812 60 FD0D.tmp FD8A.tmp PID 60 wrote to memory of 4812 60 FD0D.tmp FD8A.tmp PID 4812 wrote to memory of 4596 4812 FD8A.tmp FDE8.tmp PID 4812 wrote to memory of 4596 4812 FD8A.tmp FDE8.tmp PID 4812 wrote to memory of 4596 4812 FD8A.tmp FDE8.tmp PID 4596 wrote to memory of 2904 4596 FDE8.tmp FE46.tmp PID 4596 wrote to memory of 2904 4596 FDE8.tmp FE46.tmp PID 4596 wrote to memory of 2904 4596 FDE8.tmp FE46.tmp PID 2904 wrote to memory of 2184 2904 FE46.tmp FEC3.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_07b748a13c2b6ede2a3f65c8b108b90a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"23⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"24⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"25⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"26⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"27⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"28⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"29⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"30⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"31⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"32⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"33⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"34⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"35⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"36⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"37⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"38⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"39⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"40⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"41⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"42⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"43⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"44⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"45⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"46⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"47⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"48⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"49⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"50⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"51⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"52⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"53⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"54⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"55⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"56⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"57⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"58⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"59⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"60⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"61⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"62⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"63⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"64⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"65⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"66⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"67⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"68⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"69⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"70⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"71⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"72⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"73⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"74⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"75⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"76⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"77⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"79⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"80⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"81⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"82⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"83⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"84⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"85⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"86⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"87⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"88⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"89⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"90⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"91⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"92⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"93⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"94⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"95⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"96⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"97⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"98⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"99⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"100⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"102⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"103⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"104⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"105⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"106⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"107⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"108⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"109⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"110⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"111⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"112⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"113⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"114⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"115⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"116⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"117⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"118⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"119⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"120⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"121⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-