Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe
-
Size
765KB
-
MD5
5a8fe30487bec4e5ec1d9f8e24d670da
-
SHA1
e5cc962cd8cc4e9a5417c84198f5dfcf330ef3d6
-
SHA256
5c2bfaac0051fc5eb6bafa0044f0043b1116953b34a799483f256004bacfadc8
-
SHA512
556977d3386656b6bedea6d52db82493e8e511358d7bbfeb683045a249a129d1876f8470a62be5569c76568c32fcdee00ec3593705cf58e5fa370321394aea68
-
SSDEEP
12288:ZU5rCOTeiDnbNh5GobW9YCA3ZF5rn5rLOa54U5w5A:ZUQOJD5h5GjYCA3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3948 5C1A.tmp 2988 5C97.tmp 3700 5D33.tmp 3104 5DEF.tmp 4300 5E7B.tmp 388 5EE9.tmp 2128 5F75.tmp 3672 5FF2.tmp 768 606F.tmp 1336 60FC.tmp 4236 6198.tmp 3204 61F6.tmp 1808 6273.tmp 3620 62E0.tmp 1760 633E.tmp 2548 63AB.tmp 1508 6428.tmp 3808 64A5.tmp 4052 6503.tmp 1376 6571.tmp 4408 65EE.tmp 1148 667A.tmp 1608 6707.tmp 1824 6765.tmp 4020 67C2.tmp 400 6830.tmp 2512 68AD.tmp 3392 6939.tmp 3944 69A7.tmp 4008 6A53.tmp 4440 6AD0.tmp 5068 6B5C.tmp 4356 6BD9.tmp 3948 6C27.tmp 2372 6C75.tmp 4452 6CC4.tmp 2364 6D12.tmp 2132 6D60.tmp 1540 6DBE.tmp 2156 6E0C.tmp 1288 6E69.tmp 1032 6EC7.tmp 3568 6F25.tmp 4328 6F73.tmp 1220 6FC1.tmp 4160 700F.tmp 404 706D.tmp 2116 70BB.tmp 768 7119.tmp 2380 7167.tmp 4472 71B5.tmp 3876 7203.tmp 2252 7261.tmp 4868 72BF.tmp 444 731D.tmp 2292 737A.tmp 4972 73D8.tmp 4492 7436.tmp 1756 7494.tmp 316 74E2.tmp 1980 753F.tmp 4728 758E.tmp 2280 75EB.tmp 2436 7649.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3948 4612 2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe 83 PID 4612 wrote to memory of 3948 4612 2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe 83 PID 4612 wrote to memory of 3948 4612 2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe 83 PID 3948 wrote to memory of 2988 3948 5C1A.tmp 84 PID 3948 wrote to memory of 2988 3948 5C1A.tmp 84 PID 3948 wrote to memory of 2988 3948 5C1A.tmp 84 PID 2988 wrote to memory of 3700 2988 5C97.tmp 86 PID 2988 wrote to memory of 3700 2988 5C97.tmp 86 PID 2988 wrote to memory of 3700 2988 5C97.tmp 86 PID 3700 wrote to memory of 3104 3700 5D33.tmp 88 PID 3700 wrote to memory of 3104 3700 5D33.tmp 88 PID 3700 wrote to memory of 3104 3700 5D33.tmp 88 PID 3104 wrote to memory of 4300 3104 5DEF.tmp 90 PID 3104 wrote to memory of 4300 3104 5DEF.tmp 90 PID 3104 wrote to memory of 4300 3104 5DEF.tmp 90 PID 4300 wrote to memory of 388 4300 5E7B.tmp 91 PID 4300 wrote to memory of 388 4300 5E7B.tmp 91 PID 4300 wrote to memory of 388 4300 5E7B.tmp 91 PID 388 wrote to memory of 2128 388 5EE9.tmp 92 PID 388 wrote to memory of 2128 388 5EE9.tmp 92 PID 388 wrote to memory of 2128 388 5EE9.tmp 92 PID 2128 wrote to memory of 3672 2128 5F75.tmp 93 PID 2128 wrote to memory of 3672 2128 5F75.tmp 93 PID 2128 wrote to memory of 3672 2128 5F75.tmp 93 PID 3672 wrote to memory of 768 3672 5FF2.tmp 94 PID 3672 wrote to memory of 768 3672 5FF2.tmp 94 PID 3672 wrote to memory of 768 3672 5FF2.tmp 94 PID 768 wrote to memory of 1336 768 606F.tmp 95 PID 768 wrote to memory of 1336 768 606F.tmp 95 PID 768 wrote to memory of 1336 768 606F.tmp 95 PID 1336 wrote to memory of 4236 1336 60FC.tmp 96 PID 1336 wrote to memory of 4236 1336 60FC.tmp 96 PID 1336 wrote to memory of 4236 1336 60FC.tmp 96 PID 4236 wrote to memory of 3204 4236 6198.tmp 97 PID 4236 wrote to memory of 3204 4236 6198.tmp 97 PID 4236 wrote to memory of 3204 4236 6198.tmp 97 PID 3204 wrote to memory of 1808 3204 61F6.tmp 98 PID 3204 wrote to memory of 1808 3204 61F6.tmp 98 PID 3204 wrote to memory of 1808 3204 61F6.tmp 98 PID 1808 wrote to memory of 3620 1808 6273.tmp 99 PID 1808 wrote to memory of 3620 1808 6273.tmp 99 PID 1808 wrote to memory of 3620 1808 6273.tmp 99 PID 3620 wrote to memory of 1760 3620 62E0.tmp 100 PID 3620 wrote to memory of 1760 3620 62E0.tmp 100 PID 3620 wrote to memory of 1760 3620 62E0.tmp 100 PID 1760 wrote to memory of 2548 1760 633E.tmp 101 PID 1760 wrote to memory of 2548 1760 633E.tmp 101 PID 1760 wrote to memory of 2548 1760 633E.tmp 101 PID 2548 wrote to memory of 1508 2548 63AB.tmp 102 PID 2548 wrote to memory of 1508 2548 63AB.tmp 102 PID 2548 wrote to memory of 1508 2548 63AB.tmp 102 PID 1508 wrote to memory of 3808 1508 6428.tmp 103 PID 1508 wrote to memory of 3808 1508 6428.tmp 103 PID 1508 wrote to memory of 3808 1508 6428.tmp 103 PID 3808 wrote to memory of 4052 3808 64A5.tmp 104 PID 3808 wrote to memory of 4052 3808 64A5.tmp 104 PID 3808 wrote to memory of 4052 3808 64A5.tmp 104 PID 4052 wrote to memory of 1376 4052 6503.tmp 105 PID 4052 wrote to memory of 1376 4052 6503.tmp 105 PID 4052 wrote to memory of 1376 4052 6503.tmp 105 PID 1376 wrote to memory of 4408 1376 6571.tmp 108 PID 1376 wrote to memory of 4408 1376 6571.tmp 108 PID 1376 wrote to memory of 4408 1376 6571.tmp 108 PID 4408 wrote to memory of 1148 4408 65EE.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_5a8fe30487bec4e5ec1d9f8e24d670da_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"23⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"24⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"25⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"26⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"27⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"28⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"29⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"30⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"31⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"32⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"33⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"34⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"35⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"36⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"37⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"38⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"39⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"40⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"41⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"42⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"43⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"44⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"45⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"46⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"47⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"48⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"49⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"50⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"51⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"53⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"54⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"55⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"56⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"57⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"58⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"59⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"60⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"61⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"62⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"63⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"64⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"65⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"66⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"67⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"68⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"69⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"70⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"71⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"72⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"73⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"74⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"75⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"76⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"77⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"78⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"79⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"80⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"81⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"82⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"83⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"84⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"85⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"86⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"87⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"88⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"89⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"90⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"91⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"92⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"93⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"94⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"96⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"97⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"98⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"99⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"100⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"101⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"102⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"103⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"104⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"105⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"106⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"107⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"108⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"109⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"110⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"111⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"112⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"114⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"115⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"116⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"117⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"118⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"119⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"120⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"121⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-