Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe
-
Size
530KB
-
MD5
5c5acbe12fd4bf7963fa73fcd47e513d
-
SHA1
910dd5125861cfd1e94080043cdf0848a1921706
-
SHA256
9ae8c18294a593ba49d3996f0fb30cb06bf25df95f94d1cb166047a70d2b25aa
-
SHA512
a0214a4a625ba0159268c2285c18c0dba24904006d7ebf725a0d403e15bd9c1806a6bb123188301d215e3e467f1cd043e52d88795b7aadd4d274e3d6f9611fd7
-
SSDEEP
12288:AU5rCOTeioCbQq7t65E7dV2HRRNZulFVg0M1:AUQOJog45E7dVgRNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 208 569C.tmp 1636 56F9.tmp 1168 5757.tmp 3240 57C5.tmp 1936 5822.tmp 4692 5880.tmp 4824 58ED.tmp 380 593C.tmp 3928 5999.tmp 4808 59E7.tmp 532 5A55.tmp 3472 5AC2.tmp 3256 5B3F.tmp 996 5BAD.tmp 5004 5C1A.tmp 2728 5C68.tmp 4584 5CB6.tmp 4960 5D04.tmp 2868 5D62.tmp 4624 5DC0.tmp 2592 5E0E.tmp 3268 5E5C.tmp 4472 5EC9.tmp 4992 5F27.tmp 2888 5F85.tmp 916 5FF2.tmp 2000 6050.tmp 4336 60BD.tmp 4056 611B.tmp 436 6179.tmp 1360 61D7.tmp 364 6234.tmp 4824 6292.tmp 2920 62F0.tmp 380 634E.tmp 4516 63AB.tmp 2108 63FA.tmp 4020 6448.tmp 1816 6496.tmp 996 64F4.tmp 3140 6542.tmp 3420 6590.tmp 1576 65EE.tmp 4396 664B.tmp 2932 6699.tmp 2464 66F7.tmp 4404 6755.tmp 2260 67B3.tmp 2084 6820.tmp 3788 687E.tmp 3576 68DC.tmp 3712 692A.tmp 2000 6987.tmp 4432 69E5.tmp 460 6A43.tmp 3216 6AA1.tmp 3252 6AFE.tmp 4532 6B4D.tmp 3428 6B9B.tmp 716 6BF8.tmp 1144 6C56.tmp 864 6CB4.tmp 3964 6D12.tmp 4632 6D60.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 208 388 2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe 86 PID 388 wrote to memory of 208 388 2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe 86 PID 388 wrote to memory of 208 388 2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe 86 PID 208 wrote to memory of 1636 208 569C.tmp 90 PID 208 wrote to memory of 1636 208 569C.tmp 90 PID 208 wrote to memory of 1636 208 569C.tmp 90 PID 1636 wrote to memory of 1168 1636 56F9.tmp 91 PID 1636 wrote to memory of 1168 1636 56F9.tmp 91 PID 1636 wrote to memory of 1168 1636 56F9.tmp 91 PID 1168 wrote to memory of 3240 1168 5757.tmp 93 PID 1168 wrote to memory of 3240 1168 5757.tmp 93 PID 1168 wrote to memory of 3240 1168 5757.tmp 93 PID 3240 wrote to memory of 1936 3240 57C5.tmp 94 PID 3240 wrote to memory of 1936 3240 57C5.tmp 94 PID 3240 wrote to memory of 1936 3240 57C5.tmp 94 PID 1936 wrote to memory of 4692 1936 5822.tmp 95 PID 1936 wrote to memory of 4692 1936 5822.tmp 95 PID 1936 wrote to memory of 4692 1936 5822.tmp 95 PID 4692 wrote to memory of 4824 4692 5880.tmp 96 PID 4692 wrote to memory of 4824 4692 5880.tmp 96 PID 4692 wrote to memory of 4824 4692 5880.tmp 96 PID 4824 wrote to memory of 380 4824 58ED.tmp 99 PID 4824 wrote to memory of 380 4824 58ED.tmp 99 PID 4824 wrote to memory of 380 4824 58ED.tmp 99 PID 380 wrote to memory of 3928 380 593C.tmp 101 PID 380 wrote to memory of 3928 380 593C.tmp 101 PID 380 wrote to memory of 3928 380 593C.tmp 101 PID 3928 wrote to memory of 4808 3928 5999.tmp 102 PID 3928 wrote to memory of 4808 3928 5999.tmp 102 PID 3928 wrote to memory of 4808 3928 5999.tmp 102 PID 4808 wrote to memory of 532 4808 59E7.tmp 103 PID 4808 wrote to memory of 532 4808 59E7.tmp 103 PID 4808 wrote to memory of 532 4808 59E7.tmp 103 PID 532 wrote to memory of 3472 532 5A55.tmp 104 PID 532 wrote to memory of 3472 532 5A55.tmp 104 PID 532 wrote to memory of 3472 532 5A55.tmp 104 PID 3472 wrote to memory of 3256 3472 5AC2.tmp 105 PID 3472 wrote to memory of 3256 3472 5AC2.tmp 105 PID 3472 wrote to memory of 3256 3472 5AC2.tmp 105 PID 3256 wrote to memory of 996 3256 5B3F.tmp 106 PID 3256 wrote to memory of 996 3256 5B3F.tmp 106 PID 3256 wrote to memory of 996 3256 5B3F.tmp 106 PID 996 wrote to memory of 5004 996 5BAD.tmp 107 PID 996 wrote to memory of 5004 996 5BAD.tmp 107 PID 996 wrote to memory of 5004 996 5BAD.tmp 107 PID 5004 wrote to memory of 2728 5004 5C1A.tmp 108 PID 5004 wrote to memory of 2728 5004 5C1A.tmp 108 PID 5004 wrote to memory of 2728 5004 5C1A.tmp 108 PID 2728 wrote to memory of 4584 2728 5C68.tmp 109 PID 2728 wrote to memory of 4584 2728 5C68.tmp 109 PID 2728 wrote to memory of 4584 2728 5C68.tmp 109 PID 4584 wrote to memory of 4960 4584 5CB6.tmp 110 PID 4584 wrote to memory of 4960 4584 5CB6.tmp 110 PID 4584 wrote to memory of 4960 4584 5CB6.tmp 110 PID 4960 wrote to memory of 2868 4960 5D04.tmp 111 PID 4960 wrote to memory of 2868 4960 5D04.tmp 111 PID 4960 wrote to memory of 2868 4960 5D04.tmp 111 PID 2868 wrote to memory of 4624 2868 5D62.tmp 112 PID 2868 wrote to memory of 4624 2868 5D62.tmp 112 PID 2868 wrote to memory of 4624 2868 5D62.tmp 112 PID 4624 wrote to memory of 2592 4624 5DC0.tmp 113 PID 4624 wrote to memory of 2592 4624 5DC0.tmp 113 PID 4624 wrote to memory of 2592 4624 5DC0.tmp 113 PID 2592 wrote to memory of 3268 2592 5E0E.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_5c5acbe12fd4bf7963fa73fcd47e513d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"23⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"24⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"25⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"26⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"27⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"28⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"29⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"30⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"31⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"32⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"33⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"34⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"35⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"36⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"37⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"38⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"39⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"40⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"41⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"42⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"43⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"44⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"45⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"46⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"47⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"48⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"49⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"50⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"51⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"52⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"53⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"54⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"55⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"56⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"57⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"58⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"59⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"60⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"61⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"62⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"63⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"64⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"65⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"66⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"67⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"68⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"70⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"71⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"72⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"73⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"74⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"75⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"76⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"77⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"78⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"79⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"80⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"81⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"82⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"84⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"85⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"86⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"87⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"88⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"89⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"90⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"91⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"92⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"93⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"94⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"95⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"96⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"97⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"98⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"99⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"100⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"101⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"102⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"103⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"104⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"105⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"106⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"107⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"108⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"109⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"110⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"111⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"112⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"113⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"114⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"115⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"116⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"117⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"118⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"119⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"121⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"122⤵PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-