Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
-
Size
486KB
-
MD5
36e17e904264bd8b4b21db409fab6752
-
SHA1
4b9d6484d58b8c4ee9a44ea00368f5915f0ed50e
-
SHA256
cd759306cbcbb5a6849f3fb643e6398118655ba5ec101b30a77d615b67220a7e
-
SHA512
6e3255ddd030b45bdaf3625cd314c44a348b0845d4681d48745f96f0bd7a8e6bdd9c249a8b8d8522f5d989cd4868994cbc5ce81a4b3a5dcbc781d8a3b6ae184c
-
SSDEEP
12288:/U5rCOTeiDDl2xAandMNSdhneY2+yIh2zNZ:/UQOJDDgRneSdhnajvzN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4276 5B10.tmp 3828 5BAD.tmp 2872 5C1A.tmp 2268 5C87.tmp 1336 5CD5.tmp 380 5D52.tmp 2624 5DB0.tmp 3608 5E0E.tmp 5000 5E5C.tmp 2524 5EBA.tmp 2140 5F37.tmp 4880 5F95.tmp 4328 5FE3.tmp 1668 6031.tmp 4500 607F.tmp 2100 60EC.tmp 2436 614A.tmp 3300 61B7.tmp 5036 6206.tmp 648 6254.tmp 628 62B1.tmp 3012 6300.tmp 2056 634E.tmp 4612 63BB.tmp 5080 6409.tmp 2648 6467.tmp 4544 64B5.tmp 3412 6513.tmp 1180 6580.tmp 5044 65CE.tmp 1236 661C.tmp 4400 667A.tmp 1480 66D8.tmp 2340 6726.tmp 1392 6774.tmp 812 67C2.tmp 2008 6810.tmp 4640 685F.tmp 3340 68BC.tmp 1588 691A.tmp 3140 6968.tmp 4848 69C6.tmp 2916 6A24.tmp 644 6A72.tmp 1060 6AC0.tmp 676 6B1E.tmp 2616 6B6C.tmp 3820 6BBA.tmp 2432 6C18.tmp 2344 6C75.tmp 3996 6CC4.tmp 4984 6D21.tmp 4952 6D7F.tmp 3900 6DDD.tmp 4524 6E2B.tmp 3956 6E89.tmp 2420 6EE6.tmp 2084 6F44.tmp 5112 6FA2.tmp 1184 7000.tmp 2980 704E.tmp 400 709C.tmp 1912 70EA.tmp 1240 7148.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 4276 2628 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 84 PID 2628 wrote to memory of 4276 2628 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 84 PID 2628 wrote to memory of 4276 2628 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 84 PID 4276 wrote to memory of 3828 4276 5B10.tmp 85 PID 4276 wrote to memory of 3828 4276 5B10.tmp 85 PID 4276 wrote to memory of 3828 4276 5B10.tmp 85 PID 3828 wrote to memory of 2872 3828 5BAD.tmp 86 PID 3828 wrote to memory of 2872 3828 5BAD.tmp 86 PID 3828 wrote to memory of 2872 3828 5BAD.tmp 86 PID 2872 wrote to memory of 2268 2872 5C1A.tmp 87 PID 2872 wrote to memory of 2268 2872 5C1A.tmp 87 PID 2872 wrote to memory of 2268 2872 5C1A.tmp 87 PID 2268 wrote to memory of 1336 2268 5C87.tmp 88 PID 2268 wrote to memory of 1336 2268 5C87.tmp 88 PID 2268 wrote to memory of 1336 2268 5C87.tmp 88 PID 1336 wrote to memory of 380 1336 5CD5.tmp 89 PID 1336 wrote to memory of 380 1336 5CD5.tmp 89 PID 1336 wrote to memory of 380 1336 5CD5.tmp 89 PID 380 wrote to memory of 2624 380 5D52.tmp 90 PID 380 wrote to memory of 2624 380 5D52.tmp 90 PID 380 wrote to memory of 2624 380 5D52.tmp 90 PID 2624 wrote to memory of 3608 2624 5DB0.tmp 91 PID 2624 wrote to memory of 3608 2624 5DB0.tmp 91 PID 2624 wrote to memory of 3608 2624 5DB0.tmp 91 PID 3608 wrote to memory of 5000 3608 5E0E.tmp 92 PID 3608 wrote to memory of 5000 3608 5E0E.tmp 92 PID 3608 wrote to memory of 5000 3608 5E0E.tmp 92 PID 5000 wrote to memory of 2524 5000 5E5C.tmp 93 PID 5000 wrote to memory of 2524 5000 5E5C.tmp 93 PID 5000 wrote to memory of 2524 5000 5E5C.tmp 93 PID 2524 wrote to memory of 2140 2524 5EBA.tmp 94 PID 2524 wrote to memory of 2140 2524 5EBA.tmp 94 PID 2524 wrote to memory of 2140 2524 5EBA.tmp 94 PID 2140 wrote to memory of 4880 2140 5F37.tmp 95 PID 2140 wrote to memory of 4880 2140 5F37.tmp 95 PID 2140 wrote to memory of 4880 2140 5F37.tmp 95 PID 4880 wrote to memory of 4328 4880 5F95.tmp 96 PID 4880 wrote to memory of 4328 4880 5F95.tmp 96 PID 4880 wrote to memory of 4328 4880 5F95.tmp 96 PID 4328 wrote to memory of 1668 4328 5FE3.tmp 97 PID 4328 wrote to memory of 1668 4328 5FE3.tmp 97 PID 4328 wrote to memory of 1668 4328 5FE3.tmp 97 PID 1668 wrote to memory of 4500 1668 6031.tmp 98 PID 1668 wrote to memory of 4500 1668 6031.tmp 98 PID 1668 wrote to memory of 4500 1668 6031.tmp 98 PID 4500 wrote to memory of 2100 4500 607F.tmp 99 PID 4500 wrote to memory of 2100 4500 607F.tmp 99 PID 4500 wrote to memory of 2100 4500 607F.tmp 99 PID 2100 wrote to memory of 2436 2100 60EC.tmp 100 PID 2100 wrote to memory of 2436 2100 60EC.tmp 100 PID 2100 wrote to memory of 2436 2100 60EC.tmp 100 PID 2436 wrote to memory of 3300 2436 614A.tmp 101 PID 2436 wrote to memory of 3300 2436 614A.tmp 101 PID 2436 wrote to memory of 3300 2436 614A.tmp 101 PID 3300 wrote to memory of 5036 3300 61B7.tmp 102 PID 3300 wrote to memory of 5036 3300 61B7.tmp 102 PID 3300 wrote to memory of 5036 3300 61B7.tmp 102 PID 5036 wrote to memory of 648 5036 6206.tmp 103 PID 5036 wrote to memory of 648 5036 6206.tmp 103 PID 5036 wrote to memory of 648 5036 6206.tmp 103 PID 648 wrote to memory of 628 648 6254.tmp 104 PID 648 wrote to memory of 628 648 6254.tmp 104 PID 648 wrote to memory of 628 648 6254.tmp 104 PID 628 wrote to memory of 3012 628 62B1.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"23⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"24⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"25⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"27⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"28⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"29⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"30⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"31⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"32⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"33⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"34⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"35⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"36⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"37⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"38⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"39⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"40⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"41⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"42⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"43⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"44⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"45⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"46⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"47⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"48⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"49⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"50⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"51⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"52⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"53⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"54⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"55⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"56⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"57⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"58⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"59⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"60⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"61⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"62⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"63⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"64⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"65⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"66⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"67⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"68⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"69⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"70⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"71⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"72⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"73⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"74⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"75⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"76⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"77⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"78⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"79⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"80⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"81⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"82⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"83⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"85⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"86⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"87⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"88⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"89⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"90⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"91⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"92⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"93⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"94⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"95⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"96⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"97⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"98⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"99⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"100⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"101⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"102⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"103⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"104⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"105⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"106⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"108⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"109⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"110⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"111⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"112⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"113⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"114⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"116⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"117⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"118⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"119⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"120⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"121⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"122⤵PID:4008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-