Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 18:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe
-
Size
536KB
-
MD5
77c7f362e57cdf0eece7c0848ee88ea3
-
SHA1
4e5b01a6af53ae22af818361e9037fdeaff5f29d
-
SHA256
325f1e5bd839806e47b180f769c5ce524761c668d21914386684cc46fe76d4b8
-
SHA512
e11deb8669805af3050f8d722e105eda3f309bcc616775832bf575786113971823d54ed96a569e9948192dae6f1183a85648876a4750390d0f9bca17c4d885bf
-
SSDEEP
12288:wU5rCOTeiU6LgV9D52efmJJdXj3ont4Vh5/IZxVJ0ZT9:wUQOJU6LOD52SiJdTot4VbIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4696 4D55.tmp 3452 4DE1.tmp 2152 4E5E.tmp 4128 4F49.tmp 984 4FE5.tmp 4388 5072.tmp 528 50FE.tmp 1424 519A.tmp 396 5237.tmp 3000 52D3.tmp 412 5350.tmp 4968 53DD.tmp 756 5479.tmp 2688 54F6.tmp 5012 5592.tmp 2060 560F.tmp 3392 569C.tmp 220 5748.tmp 1696 57D4.tmp 4068 5861.tmp 4512 58FD.tmp 3396 596A.tmp 4864 5A26.tmp 2816 5AE1.tmp 3788 5B7E.tmp 3140 5BEB.tmp 3720 5CB6.tmp 4604 5D24.tmp 1644 5DCF.tmp 4884 5E5C.tmp 5108 5F08.tmp 5036 5FA4.tmp 4636 6050.tmp 5092 60DD.tmp 1580 615A.tmp 4348 61D7.tmp 3932 6225.tmp 4436 62A2.tmp 2184 631F.tmp 4284 636D.tmp 4976 63EA.tmp 4908 6448.tmp 4592 64A5.tmp 824 64F4.tmp 1912 6542.tmp 3624 65CE.tmp 4540 664B.tmp 3056 66C8.tmp 984 6736.tmp 2536 67A3.tmp 1524 67F1.tmp 880 683F.tmp 3040 688D.tmp 1372 68EB.tmp 2948 6939.tmp 3132 6987.tmp 1740 69E5.tmp 1800 6A33.tmp 2688 6A91.tmp 3200 6ADF.tmp 4524 6B2D.tmp 2808 6B7B.tmp 3124 6BCA.tmp 3144 6C18.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4696 3668 2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe 81 PID 3668 wrote to memory of 4696 3668 2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe 81 PID 3668 wrote to memory of 4696 3668 2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe 81 PID 4696 wrote to memory of 3452 4696 4D55.tmp 82 PID 4696 wrote to memory of 3452 4696 4D55.tmp 82 PID 4696 wrote to memory of 3452 4696 4D55.tmp 82 PID 3452 wrote to memory of 2152 3452 4DE1.tmp 83 PID 3452 wrote to memory of 2152 3452 4DE1.tmp 83 PID 3452 wrote to memory of 2152 3452 4DE1.tmp 83 PID 2152 wrote to memory of 4128 2152 4E5E.tmp 84 PID 2152 wrote to memory of 4128 2152 4E5E.tmp 84 PID 2152 wrote to memory of 4128 2152 4E5E.tmp 84 PID 4128 wrote to memory of 984 4128 4F49.tmp 85 PID 4128 wrote to memory of 984 4128 4F49.tmp 85 PID 4128 wrote to memory of 984 4128 4F49.tmp 85 PID 984 wrote to memory of 4388 984 4FE5.tmp 86 PID 984 wrote to memory of 4388 984 4FE5.tmp 86 PID 984 wrote to memory of 4388 984 4FE5.tmp 86 PID 4388 wrote to memory of 528 4388 5072.tmp 87 PID 4388 wrote to memory of 528 4388 5072.tmp 87 PID 4388 wrote to memory of 528 4388 5072.tmp 87 PID 528 wrote to memory of 1424 528 50FE.tmp 88 PID 528 wrote to memory of 1424 528 50FE.tmp 88 PID 528 wrote to memory of 1424 528 50FE.tmp 88 PID 1424 wrote to memory of 396 1424 519A.tmp 89 PID 1424 wrote to memory of 396 1424 519A.tmp 89 PID 1424 wrote to memory of 396 1424 519A.tmp 89 PID 396 wrote to memory of 3000 396 5237.tmp 90 PID 396 wrote to memory of 3000 396 5237.tmp 90 PID 396 wrote to memory of 3000 396 5237.tmp 90 PID 3000 wrote to memory of 412 3000 52D3.tmp 91 PID 3000 wrote to memory of 412 3000 52D3.tmp 91 PID 3000 wrote to memory of 412 3000 52D3.tmp 91 PID 412 wrote to memory of 4968 412 5350.tmp 92 PID 412 wrote to memory of 4968 412 5350.tmp 92 PID 412 wrote to memory of 4968 412 5350.tmp 92 PID 4968 wrote to memory of 756 4968 53DD.tmp 93 PID 4968 wrote to memory of 756 4968 53DD.tmp 93 PID 4968 wrote to memory of 756 4968 53DD.tmp 93 PID 756 wrote to memory of 2688 756 5479.tmp 94 PID 756 wrote to memory of 2688 756 5479.tmp 94 PID 756 wrote to memory of 2688 756 5479.tmp 94 PID 2688 wrote to memory of 5012 2688 54F6.tmp 95 PID 2688 wrote to memory of 5012 2688 54F6.tmp 95 PID 2688 wrote to memory of 5012 2688 54F6.tmp 95 PID 5012 wrote to memory of 2060 5012 5592.tmp 96 PID 5012 wrote to memory of 2060 5012 5592.tmp 96 PID 5012 wrote to memory of 2060 5012 5592.tmp 96 PID 2060 wrote to memory of 3392 2060 560F.tmp 97 PID 2060 wrote to memory of 3392 2060 560F.tmp 97 PID 2060 wrote to memory of 3392 2060 560F.tmp 97 PID 3392 wrote to memory of 220 3392 569C.tmp 98 PID 3392 wrote to memory of 220 3392 569C.tmp 98 PID 3392 wrote to memory of 220 3392 569C.tmp 98 PID 220 wrote to memory of 1696 220 5748.tmp 99 PID 220 wrote to memory of 1696 220 5748.tmp 99 PID 220 wrote to memory of 1696 220 5748.tmp 99 PID 1696 wrote to memory of 4068 1696 57D4.tmp 100 PID 1696 wrote to memory of 4068 1696 57D4.tmp 100 PID 1696 wrote to memory of 4068 1696 57D4.tmp 100 PID 4068 wrote to memory of 4512 4068 5861.tmp 101 PID 4068 wrote to memory of 4512 4068 5861.tmp 101 PID 4068 wrote to memory of 4512 4068 5861.tmp 101 PID 4512 wrote to memory of 3396 4512 58FD.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_77c7f362e57cdf0eece7c0848ee88ea3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"23⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"24⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"25⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"26⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"27⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"28⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"29⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"30⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"31⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"32⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"33⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"34⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"35⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"36⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"37⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"38⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"40⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"41⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"42⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"43⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"44⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"45⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"46⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"47⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"48⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"49⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"50⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"51⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"52⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"53⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"54⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"55⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"56⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"57⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"58⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"59⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"60⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"61⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"62⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"63⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"64⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"65⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"66⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"67⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"68⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"69⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"70⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"71⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"72⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"73⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"74⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"75⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"76⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"77⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"78⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"79⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"80⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"81⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"83⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"84⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"85⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"86⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"87⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"88⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"89⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"90⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"91⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"92⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"93⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"94⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"95⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"96⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"97⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"98⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"99⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"100⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"101⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"102⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"103⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"104⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"105⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"106⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"107⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"108⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"109⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"110⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"111⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"112⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"113⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"114⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"115⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"116⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"118⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"119⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"120⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"121⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"122⤵PID:3888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-