Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe
-
Size
541KB
-
MD5
c922bf1220aa765fb4c464542fe68906
-
SHA1
a0f588fe182c36ae84565fc3cf2c5f41fd73fad1
-
SHA256
e5b82d9c3b76beec9935d88399b01bfd1925717f6c949da4707d44530b9f5ddc
-
SHA512
99be5d121b9085ff89450db859d41bc4cf10483240e032d7d72844bad036df0e650c5ed5aad6aaad95d2ce6e3418d62e8fed175ccbc2774d2f8a022c85128e2a
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLjD7BepMI0HhxWzosgg1zB+WSkgn1JRL6/ESuiVN:UU5rCOTeifeHl1aJoEAKrZa73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 752 5D14.tmp 1032 5DA1.tmp 244 5E2D.tmp 1696 5EBA.tmp 2576 5F37.tmp 880 5FB4.tmp 2852 6031.tmp 3852 60FC.tmp 3916 6198.tmp 2276 6215.tmp 4524 62B1.tmp 2300 631F.tmp 3380 638C.tmp 2608 6428.tmp 4440 6496.tmp 1188 6503.tmp 1708 6580.tmp 4216 661C.tmp 1504 667A.tmp 2740 6707.tmp 5004 6784.tmp 740 67F1.tmp 3192 688D.tmp 4404 68FB.tmp 1136 6978.tmp 2836 69F5.tmp 4592 6A62.tmp 3136 6AFE.tmp 1084 6B9B.tmp 1356 6C08.tmp 2156 6C95.tmp 3836 6D12.tmp 4656 6D9E.tmp 2484 6DFC.tmp 2636 6E5A.tmp 3672 6EB8.tmp 1580 6F06.tmp 1512 6F54.tmp 2880 6FA2.tmp 1900 700F.tmp 3128 707D.tmp 4600 70EA.tmp 5000 7157.tmp 4608 71B5.tmp 3844 7203.tmp 4856 7251.tmp 440 72A0.tmp 848 72FD.tmp 2212 735B.tmp 2084 73B9.tmp 2988 7407.tmp 3388 7465.tmp 1648 74C2.tmp 3904 7530.tmp 4420 758E.tmp 1776 75EB.tmp 1092 7639.tmp 2632 76A7.tmp 3092 7705.tmp 4440 7762.tmp 4712 77B0.tmp 2260 780E.tmp 3704 785C.tmp 4888 78AA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 752 2604 2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe 83 PID 2604 wrote to memory of 752 2604 2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe 83 PID 2604 wrote to memory of 752 2604 2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe 83 PID 752 wrote to memory of 1032 752 5D14.tmp 84 PID 752 wrote to memory of 1032 752 5D14.tmp 84 PID 752 wrote to memory of 1032 752 5D14.tmp 84 PID 1032 wrote to memory of 244 1032 5DA1.tmp 86 PID 1032 wrote to memory of 244 1032 5DA1.tmp 86 PID 1032 wrote to memory of 244 1032 5DA1.tmp 86 PID 244 wrote to memory of 1696 244 5E2D.tmp 88 PID 244 wrote to memory of 1696 244 5E2D.tmp 88 PID 244 wrote to memory of 1696 244 5E2D.tmp 88 PID 1696 wrote to memory of 2576 1696 5EBA.tmp 89 PID 1696 wrote to memory of 2576 1696 5EBA.tmp 89 PID 1696 wrote to memory of 2576 1696 5EBA.tmp 89 PID 2576 wrote to memory of 880 2576 5F37.tmp 90 PID 2576 wrote to memory of 880 2576 5F37.tmp 90 PID 2576 wrote to memory of 880 2576 5F37.tmp 90 PID 880 wrote to memory of 2852 880 5FB4.tmp 92 PID 880 wrote to memory of 2852 880 5FB4.tmp 92 PID 880 wrote to memory of 2852 880 5FB4.tmp 92 PID 2852 wrote to memory of 3852 2852 6031.tmp 93 PID 2852 wrote to memory of 3852 2852 6031.tmp 93 PID 2852 wrote to memory of 3852 2852 6031.tmp 93 PID 3852 wrote to memory of 3916 3852 60FC.tmp 94 PID 3852 wrote to memory of 3916 3852 60FC.tmp 94 PID 3852 wrote to memory of 3916 3852 60FC.tmp 94 PID 3916 wrote to memory of 2276 3916 6198.tmp 95 PID 3916 wrote to memory of 2276 3916 6198.tmp 95 PID 3916 wrote to memory of 2276 3916 6198.tmp 95 PID 2276 wrote to memory of 4524 2276 6215.tmp 96 PID 2276 wrote to memory of 4524 2276 6215.tmp 96 PID 2276 wrote to memory of 4524 2276 6215.tmp 96 PID 4524 wrote to memory of 2300 4524 62B1.tmp 97 PID 4524 wrote to memory of 2300 4524 62B1.tmp 97 PID 4524 wrote to memory of 2300 4524 62B1.tmp 97 PID 2300 wrote to memory of 3380 2300 631F.tmp 98 PID 2300 wrote to memory of 3380 2300 631F.tmp 98 PID 2300 wrote to memory of 3380 2300 631F.tmp 98 PID 3380 wrote to memory of 2608 3380 638C.tmp 99 PID 3380 wrote to memory of 2608 3380 638C.tmp 99 PID 3380 wrote to memory of 2608 3380 638C.tmp 99 PID 2608 wrote to memory of 4440 2608 6428.tmp 100 PID 2608 wrote to memory of 4440 2608 6428.tmp 100 PID 2608 wrote to memory of 4440 2608 6428.tmp 100 PID 4440 wrote to memory of 1188 4440 6496.tmp 101 PID 4440 wrote to memory of 1188 4440 6496.tmp 101 PID 4440 wrote to memory of 1188 4440 6496.tmp 101 PID 1188 wrote to memory of 1708 1188 6503.tmp 102 PID 1188 wrote to memory of 1708 1188 6503.tmp 102 PID 1188 wrote to memory of 1708 1188 6503.tmp 102 PID 1708 wrote to memory of 4216 1708 6580.tmp 103 PID 1708 wrote to memory of 4216 1708 6580.tmp 103 PID 1708 wrote to memory of 4216 1708 6580.tmp 103 PID 4216 wrote to memory of 1504 4216 661C.tmp 104 PID 4216 wrote to memory of 1504 4216 661C.tmp 104 PID 4216 wrote to memory of 1504 4216 661C.tmp 104 PID 1504 wrote to memory of 2740 1504 667A.tmp 105 PID 1504 wrote to memory of 2740 1504 667A.tmp 105 PID 1504 wrote to memory of 2740 1504 667A.tmp 105 PID 2740 wrote to memory of 5004 2740 6707.tmp 106 PID 2740 wrote to memory of 5004 2740 6707.tmp 106 PID 2740 wrote to memory of 5004 2740 6707.tmp 106 PID 5004 wrote to memory of 740 5004 6784.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_c922bf1220aa765fb4c464542fe68906_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"23⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"24⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"25⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"26⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"27⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"28⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"29⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"30⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"31⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"32⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"33⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"34⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"35⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"36⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"37⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"38⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"39⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"40⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"41⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"42⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"43⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"44⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"45⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"46⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"47⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"48⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"49⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"50⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"51⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"52⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"53⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"54⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"55⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"56⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"57⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"58⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"59⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"60⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"61⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"62⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"63⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"64⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"65⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"66⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"67⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"68⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"69⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"70⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"71⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"72⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"73⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"74⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"75⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"76⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"77⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"78⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"79⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"80⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"81⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"83⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"84⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"85⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"86⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"87⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"88⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"89⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"90⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"91⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"92⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"93⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"94⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"95⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"96⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"97⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"98⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"99⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"100⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"101⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"102⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"103⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"105⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"106⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"107⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"108⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"109⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"110⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"111⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"112⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"113⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"114⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"115⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"116⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"117⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"118⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"119⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"120⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"121⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"122⤵PID:3168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-