Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 12:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe
-
Size
486KB
-
MD5
39bd6ae20dee7f46179bf58d0ec5b996
-
SHA1
64c9e9141b22e1c00ffbd6f11749c8d22cd26956
-
SHA256
7e1b76098b7b1c6989430aa6e42ece60c6b0e37f0759db48ecc1cad64aa6a379
-
SHA512
583c7a4f0573765d58d0440efbe706573f6b8754be0c47cd1d86cd8066ea933c8c6a27e0b5d7beb4c6ee4f3e5dc1782b6693f4a769889dce7d916b4665cc0a1e
-
SSDEEP
12288:/U5rCOTeiDqz11QEDWXA+s91tm1FTcjbUfDjaJNZ:/UQOJDqzIocVs91Q1FTIbUfX0N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3760 4F58.tmp 3720 5004.tmp 4944 5081.tmp 880 512D.tmp 3960 51BA.tmp 4504 5237.tmp 4052 52B4.tmp 3668 5321.tmp 1392 537F.tmp 1964 53EC.tmp 4592 5469.tmp 2396 54F6.tmp 1520 5582.tmp 2016 561F.tmp 2008 568C.tmp 4152 56F9.tmp 2864 5748.tmp 1060 57B5.tmp 1012 5851.tmp 3004 58DE.tmp 2604 596A.tmp 756 59D8.tmp 3124 5A84.tmp 1496 5B10.tmp 1028 5B7E.tmp 1508 5BDB.tmp 3420 5C58.tmp 384 5CE5.tmp 3512 5D52.tmp 1512 5DCF.tmp 4156 5E5C.tmp 1432 5EC9.tmp 4620 5F37.tmp 2276 5F95.tmp 1856 5FF2.tmp 3436 6040.tmp 4488 609E.tmp 4532 60FC.tmp 4304 614A.tmp 1896 61C7.tmp 2872 6234.tmp 316 6292.tmp 2328 6300.tmp 3092 634E.tmp 2924 63BB.tmp 212 6428.tmp 396 6496.tmp 2164 64E4.tmp 1628 6551.tmp 880 659F.tmp 2832 660D.tmp 3136 666B.tmp 2892 66D8.tmp 2804 6726.tmp 3668 6784.tmp 4084 67E2.tmp 2720 6830.tmp 764 688D.tmp 1204 68FB.tmp 5024 6949.tmp 1376 69B6.tmp 3992 6A24.tmp 3332 6A91.tmp 3028 6AEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3760 2872 2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe 85 PID 2872 wrote to memory of 3760 2872 2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe 85 PID 2872 wrote to memory of 3760 2872 2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe 85 PID 3760 wrote to memory of 3720 3760 4F58.tmp 87 PID 3760 wrote to memory of 3720 3760 4F58.tmp 87 PID 3760 wrote to memory of 3720 3760 4F58.tmp 87 PID 3720 wrote to memory of 4944 3720 5004.tmp 89 PID 3720 wrote to memory of 4944 3720 5004.tmp 89 PID 3720 wrote to memory of 4944 3720 5004.tmp 89 PID 4944 wrote to memory of 880 4944 5081.tmp 90 PID 4944 wrote to memory of 880 4944 5081.tmp 90 PID 4944 wrote to memory of 880 4944 5081.tmp 90 PID 880 wrote to memory of 3960 880 512D.tmp 91 PID 880 wrote to memory of 3960 880 512D.tmp 91 PID 880 wrote to memory of 3960 880 512D.tmp 91 PID 3960 wrote to memory of 4504 3960 51BA.tmp 92 PID 3960 wrote to memory of 4504 3960 51BA.tmp 92 PID 3960 wrote to memory of 4504 3960 51BA.tmp 92 PID 4504 wrote to memory of 4052 4504 5237.tmp 93 PID 4504 wrote to memory of 4052 4504 5237.tmp 93 PID 4504 wrote to memory of 4052 4504 5237.tmp 93 PID 4052 wrote to memory of 3668 4052 52B4.tmp 94 PID 4052 wrote to memory of 3668 4052 52B4.tmp 94 PID 4052 wrote to memory of 3668 4052 52B4.tmp 94 PID 3668 wrote to memory of 1392 3668 5321.tmp 95 PID 3668 wrote to memory of 1392 3668 5321.tmp 95 PID 3668 wrote to memory of 1392 3668 5321.tmp 95 PID 1392 wrote to memory of 1964 1392 537F.tmp 96 PID 1392 wrote to memory of 1964 1392 537F.tmp 96 PID 1392 wrote to memory of 1964 1392 537F.tmp 96 PID 1964 wrote to memory of 4592 1964 53EC.tmp 97 PID 1964 wrote to memory of 4592 1964 53EC.tmp 97 PID 1964 wrote to memory of 4592 1964 53EC.tmp 97 PID 4592 wrote to memory of 2396 4592 5469.tmp 98 PID 4592 wrote to memory of 2396 4592 5469.tmp 98 PID 4592 wrote to memory of 2396 4592 5469.tmp 98 PID 2396 wrote to memory of 1520 2396 54F6.tmp 99 PID 2396 wrote to memory of 1520 2396 54F6.tmp 99 PID 2396 wrote to memory of 1520 2396 54F6.tmp 99 PID 1520 wrote to memory of 2016 1520 5582.tmp 100 PID 1520 wrote to memory of 2016 1520 5582.tmp 100 PID 1520 wrote to memory of 2016 1520 5582.tmp 100 PID 2016 wrote to memory of 2008 2016 561F.tmp 101 PID 2016 wrote to memory of 2008 2016 561F.tmp 101 PID 2016 wrote to memory of 2008 2016 561F.tmp 101 PID 2008 wrote to memory of 4152 2008 568C.tmp 102 PID 2008 wrote to memory of 4152 2008 568C.tmp 102 PID 2008 wrote to memory of 4152 2008 568C.tmp 102 PID 4152 wrote to memory of 2864 4152 56F9.tmp 103 PID 4152 wrote to memory of 2864 4152 56F9.tmp 103 PID 4152 wrote to memory of 2864 4152 56F9.tmp 103 PID 2864 wrote to memory of 1060 2864 5748.tmp 104 PID 2864 wrote to memory of 1060 2864 5748.tmp 104 PID 2864 wrote to memory of 1060 2864 5748.tmp 104 PID 1060 wrote to memory of 1012 1060 57B5.tmp 105 PID 1060 wrote to memory of 1012 1060 57B5.tmp 105 PID 1060 wrote to memory of 1012 1060 57B5.tmp 105 PID 1012 wrote to memory of 3004 1012 5851.tmp 106 PID 1012 wrote to memory of 3004 1012 5851.tmp 106 PID 1012 wrote to memory of 3004 1012 5851.tmp 106 PID 3004 wrote to memory of 2604 3004 58DE.tmp 107 PID 3004 wrote to memory of 2604 3004 58DE.tmp 107 PID 3004 wrote to memory of 2604 3004 58DE.tmp 107 PID 2604 wrote to memory of 756 2604 596A.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_39bd6ae20dee7f46179bf58d0ec5b996_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"23⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"24⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"25⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"26⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"27⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"28⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"29⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"30⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"31⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"32⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"33⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"34⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"35⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"36⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"37⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"38⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"39⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"40⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"41⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"42⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"43⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"44⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"45⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"46⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"47⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"48⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"49⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"50⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"51⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"52⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"53⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"54⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"55⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"56⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"57⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"58⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"59⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"60⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"61⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"62⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"63⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"64⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"65⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"66⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"68⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"69⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"70⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"71⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"72⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"73⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"74⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"75⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"76⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"78⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"79⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"80⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"81⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"82⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"83⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"84⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"85⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"86⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"87⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"88⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"89⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"90⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"91⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"92⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"93⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"94⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"95⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"96⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"97⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"98⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"99⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"100⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"101⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"102⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"103⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"104⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"105⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"106⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"107⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"108⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"110⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"111⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"112⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"113⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"114⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"115⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"116⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"117⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"118⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"119⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"120⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-