Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe
-
Size
765KB
-
MD5
0003f9d02484604cdb6b25aa208b5f97
-
SHA1
57661eb40236c53ca938f888625ebf494f87c5cf
-
SHA256
f2299901573f26f3733d807756cee3f2913447e0fd3e01c87898afae9632cc28
-
SHA512
43aab411bb7cb6ea2c7d94682ab127e8056fba532519b9894af280058105fea0caa58f502b30476b5000be185d64b890954193a6308b5cfd4f05a7b9ac4b5fb7
-
SSDEEP
12288:ZU5rCOTeiD1dk3pa9ptwqpttKvZAZV3ZF5rn5rLOa54U5w5A:ZUQOJD1dk3s9Lka3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4476 515C.tmp 2972 5217.tmp 4036 52A4.tmp 2004 5350.tmp 4608 53CD.tmp 4104 544A.tmp 2740 54E6.tmp 4836 5554.tmp 4416 55B1.tmp 3060 562E.tmp 4000 568C.tmp 2468 5709.tmp 2688 5767.tmp 1404 57D4.tmp 1492 5842.tmp 820 5890.tmp 1984 590D.tmp 400 597A.tmp 4648 59F7.tmp 828 5A64.tmp 4664 5AF1.tmp 3640 5B8D.tmp 5044 5C0A.tmp 2136 5C78.tmp 5084 5D04.tmp 4056 5D81.tmp 3328 5E0E.tmp 3212 5E5C.tmp 3516 5EC9.tmp 648 5F27.tmp 980 5F75.tmp 2512 5FD3.tmp 3460 6060.tmp 2640 60AE.tmp 3524 60FC.tmp 3176 615A.tmp 4852 61A8.tmp 4388 6206.tmp 4276 6263.tmp 4252 62C1.tmp 3820 630F.tmp 5064 636D.tmp 1640 63BB.tmp 4808 6419.tmp 1500 6477.tmp 1912 64E4.tmp 2180 6542.tmp 1064 6590.tmp 4060 65DE.tmp 1544 662C.tmp 2804 667A.tmp 336 66C8.tmp 4484 6726.tmp 1632 6774.tmp 1968 67D2.tmp 2308 6820.tmp 4392 686E.tmp 3716 68CC.tmp 2412 691A.tmp 4528 6968.tmp 1980 69B6.tmp 1888 6A04.tmp 4908 6A53.tmp 2196 6A91.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4476 4804 2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe 81 PID 4804 wrote to memory of 4476 4804 2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe 81 PID 4804 wrote to memory of 4476 4804 2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe 81 PID 4476 wrote to memory of 2972 4476 515C.tmp 82 PID 4476 wrote to memory of 2972 4476 515C.tmp 82 PID 4476 wrote to memory of 2972 4476 515C.tmp 82 PID 2972 wrote to memory of 4036 2972 5217.tmp 83 PID 2972 wrote to memory of 4036 2972 5217.tmp 83 PID 2972 wrote to memory of 4036 2972 5217.tmp 83 PID 4036 wrote to memory of 2004 4036 52A4.tmp 84 PID 4036 wrote to memory of 2004 4036 52A4.tmp 84 PID 4036 wrote to memory of 2004 4036 52A4.tmp 84 PID 2004 wrote to memory of 4608 2004 5350.tmp 85 PID 2004 wrote to memory of 4608 2004 5350.tmp 85 PID 2004 wrote to memory of 4608 2004 5350.tmp 85 PID 4608 wrote to memory of 4104 4608 53CD.tmp 86 PID 4608 wrote to memory of 4104 4608 53CD.tmp 86 PID 4608 wrote to memory of 4104 4608 53CD.tmp 86 PID 4104 wrote to memory of 2740 4104 544A.tmp 87 PID 4104 wrote to memory of 2740 4104 544A.tmp 87 PID 4104 wrote to memory of 2740 4104 544A.tmp 87 PID 2740 wrote to memory of 4836 2740 54E6.tmp 88 PID 2740 wrote to memory of 4836 2740 54E6.tmp 88 PID 2740 wrote to memory of 4836 2740 54E6.tmp 88 PID 4836 wrote to memory of 4416 4836 5554.tmp 89 PID 4836 wrote to memory of 4416 4836 5554.tmp 89 PID 4836 wrote to memory of 4416 4836 5554.tmp 89 PID 4416 wrote to memory of 3060 4416 55B1.tmp 90 PID 4416 wrote to memory of 3060 4416 55B1.tmp 90 PID 4416 wrote to memory of 3060 4416 55B1.tmp 90 PID 3060 wrote to memory of 4000 3060 562E.tmp 91 PID 3060 wrote to memory of 4000 3060 562E.tmp 91 PID 3060 wrote to memory of 4000 3060 562E.tmp 91 PID 4000 wrote to memory of 2468 4000 568C.tmp 92 PID 4000 wrote to memory of 2468 4000 568C.tmp 92 PID 4000 wrote to memory of 2468 4000 568C.tmp 92 PID 2468 wrote to memory of 2688 2468 5709.tmp 93 PID 2468 wrote to memory of 2688 2468 5709.tmp 93 PID 2468 wrote to memory of 2688 2468 5709.tmp 93 PID 2688 wrote to memory of 1404 2688 5767.tmp 94 PID 2688 wrote to memory of 1404 2688 5767.tmp 94 PID 2688 wrote to memory of 1404 2688 5767.tmp 94 PID 1404 wrote to memory of 1492 1404 57D4.tmp 95 PID 1404 wrote to memory of 1492 1404 57D4.tmp 95 PID 1404 wrote to memory of 1492 1404 57D4.tmp 95 PID 1492 wrote to memory of 820 1492 5842.tmp 96 PID 1492 wrote to memory of 820 1492 5842.tmp 96 PID 1492 wrote to memory of 820 1492 5842.tmp 96 PID 820 wrote to memory of 1984 820 5890.tmp 97 PID 820 wrote to memory of 1984 820 5890.tmp 97 PID 820 wrote to memory of 1984 820 5890.tmp 97 PID 1984 wrote to memory of 400 1984 590D.tmp 98 PID 1984 wrote to memory of 400 1984 590D.tmp 98 PID 1984 wrote to memory of 400 1984 590D.tmp 98 PID 400 wrote to memory of 4648 400 597A.tmp 99 PID 400 wrote to memory of 4648 400 597A.tmp 99 PID 400 wrote to memory of 4648 400 597A.tmp 99 PID 4648 wrote to memory of 828 4648 59F7.tmp 100 PID 4648 wrote to memory of 828 4648 59F7.tmp 100 PID 4648 wrote to memory of 828 4648 59F7.tmp 100 PID 828 wrote to memory of 4664 828 5A64.tmp 101 PID 828 wrote to memory of 4664 828 5A64.tmp 101 PID 828 wrote to memory of 4664 828 5A64.tmp 101 PID 4664 wrote to memory of 3640 4664 5AF1.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_0003f9d02484604cdb6b25aa208b5f97_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"23⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"24⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"25⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"26⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"27⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"28⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"29⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"30⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"31⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"32⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"33⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"34⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"35⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"36⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"37⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"38⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"39⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"40⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"41⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"42⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"43⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"44⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"45⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"46⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"47⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"48⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"49⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"50⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"51⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"52⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"53⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"54⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"55⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"56⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"57⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"58⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"59⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"60⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"61⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"62⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"63⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"64⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"65⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"66⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"67⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"68⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"69⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"70⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"71⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"72⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"73⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"74⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"75⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"76⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"77⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"78⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"79⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"80⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"81⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"82⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"84⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"85⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"86⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"87⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"88⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"89⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"90⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"91⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"92⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"93⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"94⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"95⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"96⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"97⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"98⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"99⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"100⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"101⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"102⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"103⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"104⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"105⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"106⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"107⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"108⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"109⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"110⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"111⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"113⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"114⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"115⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"116⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"117⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"118⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"119⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"120⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"121⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"122⤵PID:4544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-