Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe
-
Size
520KB
-
MD5
e8b3f918739705603b6b3cee6393a355
-
SHA1
a490f0353c4934212f1bbe22292f18bd7110ff96
-
SHA256
870ca4024da7e4d6aca8c66c2deea82bf3f1adc2e3bc4433098c4d91bc3022bb
-
SHA512
18bbeaa5d2d0486b15303447b9f9bad6396fc9ed78bd9ee605a32f50e3a86f54a686bcb9b345f162138b631a03b1d14594a515b545bcb93180dbd92e487b8108
-
SSDEEP
12288:roRXOQjmOyA1MnnQkOlz2WwM1yKHVy+NZ:rogQ9yA1JyWfgm8+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4872 5F95.tmp 4588 5FF2.tmp 3648 6050.tmp 4776 60AE.tmp 1080 60FC.tmp 1208 615A.tmp 4956 61B7.tmp 1888 6225.tmp 408 6292.tmp 2140 62E0.tmp 4748 632E.tmp 4304 638C.tmp 1576 63EA.tmp 2608 6438.tmp 2680 6486.tmp 2344 64E4.tmp 5016 6532.tmp 5012 6590.tmp 948 65DE.tmp 2852 662C.tmp 2356 668A.tmp 764 66D8.tmp 4532 6726.tmp 2828 6774.tmp 732 67F1.tmp 3880 683F.tmp 4408 688D.tmp 2960 68DC.tmp 4820 6939.tmp 2772 69B6.tmp 4580 6A33.tmp 1148 6AB0.tmp 4768 6AFE.tmp 4060 6B4D.tmp 464 6B9B.tmp 1344 6BE9.tmp 2416 6C56.tmp 1980 6CA4.tmp 4256 6D02.tmp 3924 6D7F.tmp 3028 6E1B.tmp 3916 6EA8.tmp 1516 6F06.tmp 4292 6F54.tmp 2260 6FB2.tmp 2148 7000.tmp 4968 704E.tmp 2216 70AC.tmp 3168 7109.tmp 4044 7167.tmp 1156 71B5.tmp 2900 7203.tmp 1696 7251.tmp 3480 72AF.tmp 1720 72FD.tmp 2796 734B.tmp 4700 73A9.tmp 1216 73F7.tmp 4772 7445.tmp 3668 7494.tmp 2004 74F1.tmp 4228 753F.tmp 628 758E.tmp 2344 75DC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4872 3092 2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe 84 PID 3092 wrote to memory of 4872 3092 2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe 84 PID 3092 wrote to memory of 4872 3092 2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe 84 PID 4872 wrote to memory of 4588 4872 5F95.tmp 86 PID 4872 wrote to memory of 4588 4872 5F95.tmp 86 PID 4872 wrote to memory of 4588 4872 5F95.tmp 86 PID 4588 wrote to memory of 3648 4588 5FF2.tmp 89 PID 4588 wrote to memory of 3648 4588 5FF2.tmp 89 PID 4588 wrote to memory of 3648 4588 5FF2.tmp 89 PID 3648 wrote to memory of 4776 3648 6050.tmp 90 PID 3648 wrote to memory of 4776 3648 6050.tmp 90 PID 3648 wrote to memory of 4776 3648 6050.tmp 90 PID 4776 wrote to memory of 1080 4776 60AE.tmp 91 PID 4776 wrote to memory of 1080 4776 60AE.tmp 91 PID 4776 wrote to memory of 1080 4776 60AE.tmp 91 PID 1080 wrote to memory of 1208 1080 60FC.tmp 92 PID 1080 wrote to memory of 1208 1080 60FC.tmp 92 PID 1080 wrote to memory of 1208 1080 60FC.tmp 92 PID 1208 wrote to memory of 4956 1208 615A.tmp 93 PID 1208 wrote to memory of 4956 1208 615A.tmp 93 PID 1208 wrote to memory of 4956 1208 615A.tmp 93 PID 4956 wrote to memory of 1888 4956 61B7.tmp 94 PID 4956 wrote to memory of 1888 4956 61B7.tmp 94 PID 4956 wrote to memory of 1888 4956 61B7.tmp 94 PID 1888 wrote to memory of 408 1888 6225.tmp 95 PID 1888 wrote to memory of 408 1888 6225.tmp 95 PID 1888 wrote to memory of 408 1888 6225.tmp 95 PID 408 wrote to memory of 2140 408 6292.tmp 96 PID 408 wrote to memory of 2140 408 6292.tmp 96 PID 408 wrote to memory of 2140 408 6292.tmp 96 PID 2140 wrote to memory of 4748 2140 62E0.tmp 97 PID 2140 wrote to memory of 4748 2140 62E0.tmp 97 PID 2140 wrote to memory of 4748 2140 62E0.tmp 97 PID 4748 wrote to memory of 4304 4748 632E.tmp 98 PID 4748 wrote to memory of 4304 4748 632E.tmp 98 PID 4748 wrote to memory of 4304 4748 632E.tmp 98 PID 4304 wrote to memory of 1576 4304 638C.tmp 99 PID 4304 wrote to memory of 1576 4304 638C.tmp 99 PID 4304 wrote to memory of 1576 4304 638C.tmp 99 PID 1576 wrote to memory of 2608 1576 63EA.tmp 100 PID 1576 wrote to memory of 2608 1576 63EA.tmp 100 PID 1576 wrote to memory of 2608 1576 63EA.tmp 100 PID 2608 wrote to memory of 2680 2608 6438.tmp 101 PID 2608 wrote to memory of 2680 2608 6438.tmp 101 PID 2608 wrote to memory of 2680 2608 6438.tmp 101 PID 2680 wrote to memory of 2344 2680 6486.tmp 102 PID 2680 wrote to memory of 2344 2680 6486.tmp 102 PID 2680 wrote to memory of 2344 2680 6486.tmp 102 PID 2344 wrote to memory of 5016 2344 64E4.tmp 103 PID 2344 wrote to memory of 5016 2344 64E4.tmp 103 PID 2344 wrote to memory of 5016 2344 64E4.tmp 103 PID 5016 wrote to memory of 5012 5016 6532.tmp 104 PID 5016 wrote to memory of 5012 5016 6532.tmp 104 PID 5016 wrote to memory of 5012 5016 6532.tmp 104 PID 5012 wrote to memory of 948 5012 6590.tmp 105 PID 5012 wrote to memory of 948 5012 6590.tmp 105 PID 5012 wrote to memory of 948 5012 6590.tmp 105 PID 948 wrote to memory of 2852 948 65DE.tmp 106 PID 948 wrote to memory of 2852 948 65DE.tmp 106 PID 948 wrote to memory of 2852 948 65DE.tmp 106 PID 2852 wrote to memory of 2356 2852 662C.tmp 107 PID 2852 wrote to memory of 2356 2852 662C.tmp 107 PID 2852 wrote to memory of 2356 2852 662C.tmp 107 PID 2356 wrote to memory of 764 2356 668A.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_e8b3f918739705603b6b3cee6393a355_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"23⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"25⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"26⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"27⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"28⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"29⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"30⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"31⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"32⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"33⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"34⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"35⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"36⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"37⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"38⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"39⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"40⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"41⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"42⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"43⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"44⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"45⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"46⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"47⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"48⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"49⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"50⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"51⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"52⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"53⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"54⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"55⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"56⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"57⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"58⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"59⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"60⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"61⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"62⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"63⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"64⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"65⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"67⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"68⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"69⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"70⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"71⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"72⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"74⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"75⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"76⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"77⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"78⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"79⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"80⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"81⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"82⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"83⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"84⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"85⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"86⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"88⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"89⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"90⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"91⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"92⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"93⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"94⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"95⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"96⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"97⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"98⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"99⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"100⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"101⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"102⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"103⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"104⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"105⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"106⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"107⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"108⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"109⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"110⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"111⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"112⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"113⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"114⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"115⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"116⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"117⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"118⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"119⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"120⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"121⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"122⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-