Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe
-
Size
520KB
-
MD5
898fd24d3e2740d9fc1b961e512d830f
-
SHA1
28a0dc431b7afc51e07159f91b7b8d23684c7df9
-
SHA256
72cee68870bc7c2a1096042618c39edbecc64a7c057b0d90605d2bfdc7ac76e7
-
SHA512
475526daae83559abf242093e639bad11380010b7c9272f3b6beb4e73e5fc54c5c975a368db09015d3a5df9799f0b56337733bb012f8bde4b18c92f8afb514e4
-
SSDEEP
12288:gj8fuxR21t5i8fI5GDz6NdrwKwZBX/DlA+WCNZ:gj8fuK1GY3Dz6EKwZd/hAPCN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 372 5275.tmp 4024 52E3.tmp 116 5350.tmp 1672 53BD.tmp 4292 543A.tmp 2296 5498.tmp 4336 5505.tmp 768 5563.tmp 1968 55C1.tmp 1056 563E.tmp 2396 569C.tmp 4064 5719.tmp 3928 5776.tmp 2008 5803.tmp 4740 5861.tmp 3716 58CE.tmp 4260 591C.tmp 2188 598A.tmp 4308 59F7.tmp 3112 5A74.tmp 4868 5AC2.tmp 4020 5B10.tmp 3184 5B6E.tmp 64 5BEB.tmp 2292 5C39.tmp 1060 5C87.tmp 4772 5D04.tmp 460 5D81.tmp 3180 5DCF.tmp 2496 5E2D.tmp 2584 5EAA.tmp 4636 5F18.tmp 2176 5F75.tmp 2784 5FE3.tmp 3256 6040.tmp 2136 609E.tmp 2704 60FC.tmp 1148 615A.tmp 1824 61A8.tmp 4808 61F6.tmp 1344 6244.tmp 1232 6292.tmp 2244 62E0.tmp 1792 632E.tmp 4468 638C.tmp 3608 63EA.tmp 4880 6448.tmp 4532 6496.tmp 3872 64E4.tmp 3144 6532.tmp 4032 6580.tmp 3836 65DE.tmp 1248 662C.tmp 1316 667A.tmp 3972 66D8.tmp 828 6726.tmp 4424 6774.tmp 3140 67C2.tmp 784 6810.tmp 1096 685F.tmp 3524 68BC.tmp 1500 691A.tmp 2036 6968.tmp 2068 69B6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 372 4244 2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe 81 PID 4244 wrote to memory of 372 4244 2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe 81 PID 4244 wrote to memory of 372 4244 2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe 81 PID 372 wrote to memory of 4024 372 5275.tmp 82 PID 372 wrote to memory of 4024 372 5275.tmp 82 PID 372 wrote to memory of 4024 372 5275.tmp 82 PID 4024 wrote to memory of 116 4024 52E3.tmp 83 PID 4024 wrote to memory of 116 4024 52E3.tmp 83 PID 4024 wrote to memory of 116 4024 52E3.tmp 83 PID 116 wrote to memory of 1672 116 5350.tmp 84 PID 116 wrote to memory of 1672 116 5350.tmp 84 PID 116 wrote to memory of 1672 116 5350.tmp 84 PID 1672 wrote to memory of 4292 1672 53BD.tmp 85 PID 1672 wrote to memory of 4292 1672 53BD.tmp 85 PID 1672 wrote to memory of 4292 1672 53BD.tmp 85 PID 4292 wrote to memory of 2296 4292 543A.tmp 86 PID 4292 wrote to memory of 2296 4292 543A.tmp 86 PID 4292 wrote to memory of 2296 4292 543A.tmp 86 PID 2296 wrote to memory of 4336 2296 5498.tmp 87 PID 2296 wrote to memory of 4336 2296 5498.tmp 87 PID 2296 wrote to memory of 4336 2296 5498.tmp 87 PID 4336 wrote to memory of 768 4336 5505.tmp 88 PID 4336 wrote to memory of 768 4336 5505.tmp 88 PID 4336 wrote to memory of 768 4336 5505.tmp 88 PID 768 wrote to memory of 1968 768 5563.tmp 89 PID 768 wrote to memory of 1968 768 5563.tmp 89 PID 768 wrote to memory of 1968 768 5563.tmp 89 PID 1968 wrote to memory of 1056 1968 55C1.tmp 90 PID 1968 wrote to memory of 1056 1968 55C1.tmp 90 PID 1968 wrote to memory of 1056 1968 55C1.tmp 90 PID 1056 wrote to memory of 2396 1056 563E.tmp 91 PID 1056 wrote to memory of 2396 1056 563E.tmp 91 PID 1056 wrote to memory of 2396 1056 563E.tmp 91 PID 2396 wrote to memory of 4064 2396 569C.tmp 92 PID 2396 wrote to memory of 4064 2396 569C.tmp 92 PID 2396 wrote to memory of 4064 2396 569C.tmp 92 PID 4064 wrote to memory of 3928 4064 5719.tmp 93 PID 4064 wrote to memory of 3928 4064 5719.tmp 93 PID 4064 wrote to memory of 3928 4064 5719.tmp 93 PID 3928 wrote to memory of 2008 3928 5776.tmp 94 PID 3928 wrote to memory of 2008 3928 5776.tmp 94 PID 3928 wrote to memory of 2008 3928 5776.tmp 94 PID 2008 wrote to memory of 4740 2008 5803.tmp 95 PID 2008 wrote to memory of 4740 2008 5803.tmp 95 PID 2008 wrote to memory of 4740 2008 5803.tmp 95 PID 4740 wrote to memory of 3716 4740 5861.tmp 96 PID 4740 wrote to memory of 3716 4740 5861.tmp 96 PID 4740 wrote to memory of 3716 4740 5861.tmp 96 PID 3716 wrote to memory of 4260 3716 58CE.tmp 97 PID 3716 wrote to memory of 4260 3716 58CE.tmp 97 PID 3716 wrote to memory of 4260 3716 58CE.tmp 97 PID 4260 wrote to memory of 2188 4260 591C.tmp 98 PID 4260 wrote to memory of 2188 4260 591C.tmp 98 PID 4260 wrote to memory of 2188 4260 591C.tmp 98 PID 2188 wrote to memory of 4308 2188 598A.tmp 99 PID 2188 wrote to memory of 4308 2188 598A.tmp 99 PID 2188 wrote to memory of 4308 2188 598A.tmp 99 PID 4308 wrote to memory of 3112 4308 59F7.tmp 100 PID 4308 wrote to memory of 3112 4308 59F7.tmp 100 PID 4308 wrote to memory of 3112 4308 59F7.tmp 100 PID 3112 wrote to memory of 4868 3112 5A74.tmp 101 PID 3112 wrote to memory of 4868 3112 5A74.tmp 101 PID 3112 wrote to memory of 4868 3112 5A74.tmp 101 PID 4868 wrote to memory of 4020 4868 5AC2.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_898fd24d3e2740d9fc1b961e512d830f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"23⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"24⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"25⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"26⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"27⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"28⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"29⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"30⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"31⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"32⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"33⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"34⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"35⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"36⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"37⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"38⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"39⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"40⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"41⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"42⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"43⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"44⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"45⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"46⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"47⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"48⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"49⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"50⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"51⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"52⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"53⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"54⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"55⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"56⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"57⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"58⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"59⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"60⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"61⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"62⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"63⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"64⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"65⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"66⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"67⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"68⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"69⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"70⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"71⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"72⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"73⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"74⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"75⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"76⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"78⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"79⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"80⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"81⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"82⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"83⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"84⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"85⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"86⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"87⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"90⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"91⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"92⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"93⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"94⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"95⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"96⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"97⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"98⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"99⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"100⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"101⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"102⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"103⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"104⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"105⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"106⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"107⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"108⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"109⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"110⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"111⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"112⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"113⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"114⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"115⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"116⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"117⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"119⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"120⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"121⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-