Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe
-
Size
536KB
-
MD5
5984fb46897437cce375bae05fefbd90
-
SHA1
f3785a8d969cbfb0bcf39ef6c9d76852a7399f26
-
SHA256
840eba9eadd627260cb5c07d08237b0a92c68e83ce1d442ef0526b8da28af4bf
-
SHA512
d32ec04a3474728d49b728b31a303cd402b1c8c5dd96d5f53cd9b97341f65688d942a9fdde478607ccd617fee51e5e875936938f621ef99af9f1cad4db8ef50f
-
SSDEEP
12288:wU5rCOTeiUbrwUMzMtIi5j0aPT32ROIZxVJ0ZT9:wUQOJUbr9ei55Pz20IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2008 498C.tmp 1204 4A57.tmp 3936 4B41.tmp 3748 4CA9.tmp 412 4D64.tmp 4892 4DF1.tmp 4708 4E9D.tmp 4916 4F49.tmp 3332 4FB6.tmp 1172 5072.tmp 3616 511D.tmp 5012 51C9.tmp 5024 5294.tmp 4636 5331.tmp 1820 53CD.tmp 4644 5488.tmp 4288 5505.tmp 4860 55A2.tmp 1252 564E.tmp 3212 5719.tmp 4460 57A5.tmp 2256 5851.tmp 1256 58FD.tmp 4000 59B9.tmp 440 5A36.tmp 3668 5AC2.tmp 4388 5B7E.tmp 2460 5C58.tmp 380 5CE5.tmp 4652 5D62.tmp 1500 5DCF.tmp 1516 5E6C.tmp 2612 5F27.tmp 2476 5F95.tmp 1292 6021.tmp 2876 608F.tmp 1460 610C.tmp 1968 6189.tmp 388 61E6.tmp 1016 6244.tmp 3784 62D1.tmp 4492 635D.tmp 1932 63BB.tmp 5040 6409.tmp 4268 64A5.tmp 3620 6503.tmp 5112 6580.tmp 4324 660D.tmp 3332 666B.tmp 640 66C8.tmp 3972 6726.tmp 1640 6784.tmp 3512 67E2.tmp 1272 683F.tmp 2292 688D.tmp 4636 68DC.tmp 4556 6939.tmp 3204 6987.tmp 4812 69D6.tmp 5036 6A24.tmp 4572 6A72.tmp 1340 6AC0.tmp 4276 6B1E.tmp 1908 6B7B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 2008 4344 2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe 82 PID 4344 wrote to memory of 2008 4344 2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe 82 PID 4344 wrote to memory of 2008 4344 2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe 82 PID 2008 wrote to memory of 1204 2008 498C.tmp 84 PID 2008 wrote to memory of 1204 2008 498C.tmp 84 PID 2008 wrote to memory of 1204 2008 498C.tmp 84 PID 1204 wrote to memory of 3936 1204 4A57.tmp 85 PID 1204 wrote to memory of 3936 1204 4A57.tmp 85 PID 1204 wrote to memory of 3936 1204 4A57.tmp 85 PID 3936 wrote to memory of 3748 3936 4B41.tmp 87 PID 3936 wrote to memory of 3748 3936 4B41.tmp 87 PID 3936 wrote to memory of 3748 3936 4B41.tmp 87 PID 3748 wrote to memory of 412 3748 4CA9.tmp 89 PID 3748 wrote to memory of 412 3748 4CA9.tmp 89 PID 3748 wrote to memory of 412 3748 4CA9.tmp 89 PID 412 wrote to memory of 4892 412 4D64.tmp 90 PID 412 wrote to memory of 4892 412 4D64.tmp 90 PID 412 wrote to memory of 4892 412 4D64.tmp 90 PID 4892 wrote to memory of 4708 4892 4DF1.tmp 91 PID 4892 wrote to memory of 4708 4892 4DF1.tmp 91 PID 4892 wrote to memory of 4708 4892 4DF1.tmp 91 PID 4708 wrote to memory of 4916 4708 4E9D.tmp 92 PID 4708 wrote to memory of 4916 4708 4E9D.tmp 92 PID 4708 wrote to memory of 4916 4708 4E9D.tmp 92 PID 4916 wrote to memory of 3332 4916 4F49.tmp 93 PID 4916 wrote to memory of 3332 4916 4F49.tmp 93 PID 4916 wrote to memory of 3332 4916 4F49.tmp 93 PID 3332 wrote to memory of 1172 3332 4FB6.tmp 94 PID 3332 wrote to memory of 1172 3332 4FB6.tmp 94 PID 3332 wrote to memory of 1172 3332 4FB6.tmp 94 PID 1172 wrote to memory of 3616 1172 5072.tmp 95 PID 1172 wrote to memory of 3616 1172 5072.tmp 95 PID 1172 wrote to memory of 3616 1172 5072.tmp 95 PID 3616 wrote to memory of 5012 3616 511D.tmp 96 PID 3616 wrote to memory of 5012 3616 511D.tmp 96 PID 3616 wrote to memory of 5012 3616 511D.tmp 96 PID 5012 wrote to memory of 5024 5012 51C9.tmp 97 PID 5012 wrote to memory of 5024 5012 51C9.tmp 97 PID 5012 wrote to memory of 5024 5012 51C9.tmp 97 PID 5024 wrote to memory of 4636 5024 5294.tmp 98 PID 5024 wrote to memory of 4636 5024 5294.tmp 98 PID 5024 wrote to memory of 4636 5024 5294.tmp 98 PID 4636 wrote to memory of 1820 4636 5331.tmp 99 PID 4636 wrote to memory of 1820 4636 5331.tmp 99 PID 4636 wrote to memory of 1820 4636 5331.tmp 99 PID 1820 wrote to memory of 4644 1820 53CD.tmp 100 PID 1820 wrote to memory of 4644 1820 53CD.tmp 100 PID 1820 wrote to memory of 4644 1820 53CD.tmp 100 PID 4644 wrote to memory of 4288 4644 5488.tmp 101 PID 4644 wrote to memory of 4288 4644 5488.tmp 101 PID 4644 wrote to memory of 4288 4644 5488.tmp 101 PID 4288 wrote to memory of 4860 4288 5505.tmp 102 PID 4288 wrote to memory of 4860 4288 5505.tmp 102 PID 4288 wrote to memory of 4860 4288 5505.tmp 102 PID 4860 wrote to memory of 1252 4860 55A2.tmp 103 PID 4860 wrote to memory of 1252 4860 55A2.tmp 103 PID 4860 wrote to memory of 1252 4860 55A2.tmp 103 PID 1252 wrote to memory of 3212 1252 564E.tmp 104 PID 1252 wrote to memory of 3212 1252 564E.tmp 104 PID 1252 wrote to memory of 3212 1252 564E.tmp 104 PID 3212 wrote to memory of 4460 3212 5719.tmp 106 PID 3212 wrote to memory of 4460 3212 5719.tmp 106 PID 3212 wrote to memory of 4460 3212 5719.tmp 106 PID 4460 wrote to memory of 2256 4460 57A5.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_5984fb46897437cce375bae05fefbd90_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"23⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"24⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"25⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"26⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"27⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"28⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"29⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"30⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"31⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"32⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"33⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"34⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"35⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"36⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"37⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"38⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"39⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"40⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"41⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"42⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"43⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"44⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"45⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"46⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"47⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"48⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"49⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"50⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"51⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"52⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"53⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"54⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"55⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"56⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"57⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"58⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"59⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"60⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"61⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"62⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"63⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"64⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"65⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"66⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"67⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"68⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"69⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"70⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"71⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"72⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"73⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"74⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"75⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"76⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"77⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"78⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"79⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"80⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"81⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"82⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"83⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"84⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"85⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"86⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"87⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"88⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"89⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"90⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"91⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"92⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"93⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"94⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"95⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"96⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"97⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"98⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"99⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"100⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"101⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"102⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"103⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"104⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"105⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"106⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"107⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"108⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"109⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"110⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"111⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"112⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"113⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"114⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"115⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"116⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"117⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"118⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"119⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"120⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"121⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"122⤵PID:1196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-