Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
-
Size
530KB
-
MD5
608706a0be08dc748f18a937a75e57bf
-
SHA1
2eaac4906fab3091cb3bdcc88624b74f41d1876a
-
SHA256
13c3c0e517e1be9539dd06ea08fccf7c66e12c8b4811a7d2d8066441554dab00
-
SHA512
be441976faa5d31d5b7fd4c36ad763261373c2422efa0ed34f1494ea726dd221464956d2d334804c0d99e5640588c613942e81d7d061a4cc5f7473b0ac76a77b
-
SSDEEP
12288:AU5rCOTeiohi21cE7S9jfcHTpwnW7TQHTNZulFVg0M1:AUQOJo021cCAjfGpwW7szNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 780 52F2.tmp 4492 537F.tmp 4028 544A.tmp 2396 54D7.tmp 4744 5554.tmp 3628 55D1.tmp 1040 564E.tmp 4308 56DA.tmp 3672 5748.tmp 548 57E4.tmp 4060 5842.tmp 1080 58BF.tmp 4728 593C.tmp 660 59B9.tmp 512 5A26.tmp 2024 5A74.tmp 1912 5AC2.tmp 888 5B4F.tmp 5116 5BBC.tmp 1256 5C39.tmp 2152 5CB6.tmp 2848 5D43.tmp 4468 5DCF.tmp 1168 5E4C.tmp 4788 5EBA.tmp 3096 5F08.tmp 3688 5F66.tmp 1820 5FC3.tmp 3972 6050.tmp 5008 60CD.tmp 3820 615A.tmp 1096 61B7.tmp 5112 6225.tmp 4312 6283.tmp 228 62D1.tmp 2792 631F.tmp 4852 637D.tmp 1992 63CB.tmp 4744 6438.tmp 2436 6486.tmp 2188 64E4.tmp 3648 6542.tmp 3884 659F.tmp 3812 65FD.tmp 2412 665B.tmp 1716 66A9.tmp 3204 66F7.tmp 1080 6745.tmp 4432 67A3.tmp 376 67F1.tmp 2884 683F.tmp 2472 688D.tmp 2024 68EB.tmp 4680 6949.tmp 1468 69A7.tmp 3636 6A04.tmp 2488 6A62.tmp 3748 6AD0.tmp 4528 6B2D.tmp 4068 6B9B.tmp 1036 6C08.tmp 2184 6C66.tmp 696 6CC4.tmp 5068 6D21.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 780 1732 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 83 PID 1732 wrote to memory of 780 1732 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 83 PID 1732 wrote to memory of 780 1732 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 83 PID 780 wrote to memory of 4492 780 52F2.tmp 84 PID 780 wrote to memory of 4492 780 52F2.tmp 84 PID 780 wrote to memory of 4492 780 52F2.tmp 84 PID 4492 wrote to memory of 4028 4492 537F.tmp 85 PID 4492 wrote to memory of 4028 4492 537F.tmp 85 PID 4492 wrote to memory of 4028 4492 537F.tmp 85 PID 4028 wrote to memory of 2396 4028 544A.tmp 86 PID 4028 wrote to memory of 2396 4028 544A.tmp 86 PID 4028 wrote to memory of 2396 4028 544A.tmp 86 PID 2396 wrote to memory of 4744 2396 54D7.tmp 88 PID 2396 wrote to memory of 4744 2396 54D7.tmp 88 PID 2396 wrote to memory of 4744 2396 54D7.tmp 88 PID 4744 wrote to memory of 3628 4744 5554.tmp 89 PID 4744 wrote to memory of 3628 4744 5554.tmp 89 PID 4744 wrote to memory of 3628 4744 5554.tmp 89 PID 3628 wrote to memory of 1040 3628 55D1.tmp 91 PID 3628 wrote to memory of 1040 3628 55D1.tmp 91 PID 3628 wrote to memory of 1040 3628 55D1.tmp 91 PID 1040 wrote to memory of 4308 1040 564E.tmp 92 PID 1040 wrote to memory of 4308 1040 564E.tmp 92 PID 1040 wrote to memory of 4308 1040 564E.tmp 92 PID 4308 wrote to memory of 3672 4308 56DA.tmp 94 PID 4308 wrote to memory of 3672 4308 56DA.tmp 94 PID 4308 wrote to memory of 3672 4308 56DA.tmp 94 PID 3672 wrote to memory of 548 3672 5748.tmp 95 PID 3672 wrote to memory of 548 3672 5748.tmp 95 PID 3672 wrote to memory of 548 3672 5748.tmp 95 PID 548 wrote to memory of 4060 548 57E4.tmp 96 PID 548 wrote to memory of 4060 548 57E4.tmp 96 PID 548 wrote to memory of 4060 548 57E4.tmp 96 PID 4060 wrote to memory of 1080 4060 5842.tmp 97 PID 4060 wrote to memory of 1080 4060 5842.tmp 97 PID 4060 wrote to memory of 1080 4060 5842.tmp 97 PID 1080 wrote to memory of 4728 1080 58BF.tmp 98 PID 1080 wrote to memory of 4728 1080 58BF.tmp 98 PID 1080 wrote to memory of 4728 1080 58BF.tmp 98 PID 4728 wrote to memory of 660 4728 593C.tmp 99 PID 4728 wrote to memory of 660 4728 593C.tmp 99 PID 4728 wrote to memory of 660 4728 593C.tmp 99 PID 660 wrote to memory of 512 660 59B9.tmp 100 PID 660 wrote to memory of 512 660 59B9.tmp 100 PID 660 wrote to memory of 512 660 59B9.tmp 100 PID 512 wrote to memory of 2024 512 5A26.tmp 101 PID 512 wrote to memory of 2024 512 5A26.tmp 101 PID 512 wrote to memory of 2024 512 5A26.tmp 101 PID 2024 wrote to memory of 1912 2024 5A74.tmp 102 PID 2024 wrote to memory of 1912 2024 5A74.tmp 102 PID 2024 wrote to memory of 1912 2024 5A74.tmp 102 PID 1912 wrote to memory of 888 1912 5AC2.tmp 103 PID 1912 wrote to memory of 888 1912 5AC2.tmp 103 PID 1912 wrote to memory of 888 1912 5AC2.tmp 103 PID 888 wrote to memory of 5116 888 5B4F.tmp 104 PID 888 wrote to memory of 5116 888 5B4F.tmp 104 PID 888 wrote to memory of 5116 888 5B4F.tmp 104 PID 5116 wrote to memory of 1256 5116 5BBC.tmp 105 PID 5116 wrote to memory of 1256 5116 5BBC.tmp 105 PID 5116 wrote to memory of 1256 5116 5BBC.tmp 105 PID 1256 wrote to memory of 2152 1256 5C39.tmp 106 PID 1256 wrote to memory of 2152 1256 5C39.tmp 106 PID 1256 wrote to memory of 2152 1256 5C39.tmp 106 PID 2152 wrote to memory of 2848 2152 5CB6.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"23⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"24⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"25⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"26⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"27⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"28⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"29⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"30⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"31⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"32⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"33⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"34⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"35⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"36⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"37⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"38⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"39⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"40⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"41⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"42⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"43⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"44⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"45⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"46⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"47⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"48⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"49⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"50⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"51⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"52⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"53⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"54⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"55⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"56⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"57⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"58⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"59⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"60⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"61⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"62⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"63⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"64⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"65⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"66⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"67⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"68⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"69⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"70⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"71⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"72⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"73⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"74⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"75⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"76⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"77⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"78⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"79⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"80⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"81⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"82⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"83⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"84⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"85⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"86⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"87⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"88⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"89⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"90⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"91⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"92⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"93⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"94⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"95⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"96⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"97⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"98⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"99⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"100⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"101⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"102⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"104⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"105⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"106⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"107⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"108⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"109⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"110⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"111⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"112⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"113⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"114⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"115⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"116⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"117⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"118⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"120⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"121⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"122⤵PID:4760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-