Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
-
Size
486KB
-
MD5
e02951487994ede2461f9b8bb59321ba
-
SHA1
61cfa968eee44d86fe4b61d3b363798fd621755d
-
SHA256
b0f101ae9149decde01b926e290328a7d21ef8fbeebd8947ed36e12da6e190f1
-
SHA512
1cb6a75d856b28bfca0e13bbffc7edf248e975bcce2d15a190b58130a3d3fb4252b17d307ea56b4921574eb278177e69a5a9ab4dcc9033318adddcfc4164ce45
-
SSDEEP
12288:/U5rCOTeiD9fi/3yaVyTtFqrL6575dmwyNZ:/UQOJD9fq3yaITu2rdm5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2600 5014.tmp 2672 50A0.tmp 2628 50FE.tmp 4092 517B.tmp 412 5217.tmp 3224 52B4.tmp 2980 5331.tmp 2536 538E.tmp 4300 542B.tmp 1348 54A8.tmp 3656 5525.tmp 3228 5582.tmp 2708 55F0.tmp 772 565D.tmp 4472 56CB.tmp 2940 5748.tmp 4524 57C5.tmp 4484 5870.tmp 1100 58DE.tmp 3604 596A.tmp 1008 59D8.tmp 1820 5A45.tmp 3372 5AC2.tmp 1748 5B30.tmp 4760 5B9D.tmp 5028 5C0A.tmp 452 5C78.tmp 3136 5CF5.tmp 4532 5D52.tmp 4816 5DCF.tmp 764 5E2D.tmp 2952 5E8B.tmp 4672 5EE9.tmp 4784 5F37.tmp 2672 5F95.tmp 2180 5FE3.tmp 4972 6050.tmp 4016 60AE.tmp 3700 610C.tmp 4776 6169.tmp 4028 61C7.tmp 2192 6225.tmp 4924 6292.tmp 4528 62E0.tmp 3708 632E.tmp 3460 637D.tmp 1492 63CB.tmp 772 6419.tmp 3788 6467.tmp 3264 64B5.tmp 4524 6503.tmp 4244 6551.tmp 2684 659F.tmp 2200 65EE.tmp 3564 665B.tmp 3728 66A9.tmp 852 6707.tmp 2640 6765.tmp 2764 67D2.tmp 1128 6830.tmp 3800 688D.tmp 4416 68FB.tmp 888 6959.tmp 2168 69C6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2600 3152 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 89 PID 3152 wrote to memory of 2600 3152 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 89 PID 3152 wrote to memory of 2600 3152 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 89 PID 2600 wrote to memory of 2672 2600 5014.tmp 90 PID 2600 wrote to memory of 2672 2600 5014.tmp 90 PID 2600 wrote to memory of 2672 2600 5014.tmp 90 PID 2672 wrote to memory of 2628 2672 50A0.tmp 91 PID 2672 wrote to memory of 2628 2672 50A0.tmp 91 PID 2672 wrote to memory of 2628 2672 50A0.tmp 91 PID 2628 wrote to memory of 4092 2628 50FE.tmp 93 PID 2628 wrote to memory of 4092 2628 50FE.tmp 93 PID 2628 wrote to memory of 4092 2628 50FE.tmp 93 PID 4092 wrote to memory of 412 4092 517B.tmp 95 PID 4092 wrote to memory of 412 4092 517B.tmp 95 PID 4092 wrote to memory of 412 4092 517B.tmp 95 PID 412 wrote to memory of 3224 412 5217.tmp 96 PID 412 wrote to memory of 3224 412 5217.tmp 96 PID 412 wrote to memory of 3224 412 5217.tmp 96 PID 3224 wrote to memory of 2980 3224 52B4.tmp 98 PID 3224 wrote to memory of 2980 3224 52B4.tmp 98 PID 3224 wrote to memory of 2980 3224 52B4.tmp 98 PID 2980 wrote to memory of 2536 2980 5331.tmp 99 PID 2980 wrote to memory of 2536 2980 5331.tmp 99 PID 2980 wrote to memory of 2536 2980 5331.tmp 99 PID 2536 wrote to memory of 4300 2536 538E.tmp 100 PID 2536 wrote to memory of 4300 2536 538E.tmp 100 PID 2536 wrote to memory of 4300 2536 538E.tmp 100 PID 4300 wrote to memory of 1348 4300 542B.tmp 101 PID 4300 wrote to memory of 1348 4300 542B.tmp 101 PID 4300 wrote to memory of 1348 4300 542B.tmp 101 PID 1348 wrote to memory of 3656 1348 54A8.tmp 102 PID 1348 wrote to memory of 3656 1348 54A8.tmp 102 PID 1348 wrote to memory of 3656 1348 54A8.tmp 102 PID 3656 wrote to memory of 3228 3656 5525.tmp 103 PID 3656 wrote to memory of 3228 3656 5525.tmp 103 PID 3656 wrote to memory of 3228 3656 5525.tmp 103 PID 3228 wrote to memory of 2708 3228 5582.tmp 104 PID 3228 wrote to memory of 2708 3228 5582.tmp 104 PID 3228 wrote to memory of 2708 3228 5582.tmp 104 PID 2708 wrote to memory of 772 2708 55F0.tmp 105 PID 2708 wrote to memory of 772 2708 55F0.tmp 105 PID 2708 wrote to memory of 772 2708 55F0.tmp 105 PID 772 wrote to memory of 4472 772 565D.tmp 106 PID 772 wrote to memory of 4472 772 565D.tmp 106 PID 772 wrote to memory of 4472 772 565D.tmp 106 PID 4472 wrote to memory of 2940 4472 56CB.tmp 107 PID 4472 wrote to memory of 2940 4472 56CB.tmp 107 PID 4472 wrote to memory of 2940 4472 56CB.tmp 107 PID 2940 wrote to memory of 4524 2940 5748.tmp 108 PID 2940 wrote to memory of 4524 2940 5748.tmp 108 PID 2940 wrote to memory of 4524 2940 5748.tmp 108 PID 4524 wrote to memory of 4484 4524 57C5.tmp 109 PID 4524 wrote to memory of 4484 4524 57C5.tmp 109 PID 4524 wrote to memory of 4484 4524 57C5.tmp 109 PID 4484 wrote to memory of 1100 4484 5870.tmp 110 PID 4484 wrote to memory of 1100 4484 5870.tmp 110 PID 4484 wrote to memory of 1100 4484 5870.tmp 110 PID 1100 wrote to memory of 3604 1100 58DE.tmp 111 PID 1100 wrote to memory of 3604 1100 58DE.tmp 111 PID 1100 wrote to memory of 3604 1100 58DE.tmp 111 PID 3604 wrote to memory of 1008 3604 596A.tmp 112 PID 3604 wrote to memory of 1008 3604 596A.tmp 112 PID 3604 wrote to memory of 1008 3604 596A.tmp 112 PID 1008 wrote to memory of 1820 1008 59D8.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"23⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"24⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"25⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"26⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"27⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"28⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"29⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"30⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"31⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"32⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"33⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"34⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"35⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"36⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"37⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"38⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"39⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"40⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"41⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"42⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"43⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"44⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"45⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"46⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"47⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"48⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"49⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"50⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"51⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"52⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"53⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"54⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"55⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"56⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"57⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"58⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"59⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"60⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"61⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"62⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"63⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"64⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"65⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"66⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"67⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"68⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"69⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"70⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"71⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"72⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"73⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"74⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"75⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"77⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"78⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"79⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"80⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"81⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"82⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"83⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"84⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"85⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"86⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"87⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"88⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"89⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"90⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"91⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"92⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"93⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"94⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"95⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"96⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"97⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"98⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"99⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"100⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"101⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"102⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"103⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"104⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"105⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"106⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"107⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"108⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"109⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"110⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"111⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"112⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"113⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"114⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"115⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"116⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"117⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"118⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"119⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"120⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"121⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-