Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe
- Size 541KB
- Sample240529-mfcntacb65
- SHA256 79618cebc602929c14f83f8fe7d1fd13006cf247d103a30ff33bdfb9868aaf71
- MD5 0819a015d82314ad27531a3581545000
- SHA1 61f635d4b0a7bf5d7744fba7c418271fa128481a
- SHA512 568d41309a0921641cbd83516b0f114b8d3e09922f1c4ad4a648403ffdaaf8c91ad1dcb44dbfc15f2d65743754d39c08285871a1e14f7e4c89772bc628e6597a
- SSDEEP 12288:UU5rCOTeifh16uV5zClWcrhzaZqrZa73ctO:UUQOJfh1zC9kYrU73ctO
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2400 54B7.tmp 528 5544.tmp 4856 55C1.tmp 1408 562E.tmp 4536 569C.tmp 2776 5719.tmp 3772 5796.tmp 3244 5803.tmp 1008 5880.tmp 112 58ED.tmp 1352 595B.tmp 2348 59C8.tmp 4284 5A26.tmp 5004 5A84.tmp 2068 5AE1.tmp 4672 5B5E.tmp 4420 5BAD.tmp 4516 5C1A.tmp 4408 5C87.tmp 5060 5CF5.tmp 2292 5D81.tmp 1524 5DDF.tmp 3376 5E5C.tmp 116 5EC9.tmp 4836 5F56.tmp 1712 5FD3.tmp 3736 6031.tmp 1640 60CD.tmp 4444 612B.tmp 4044 6189.tmp 4396 6206.tmp 4800 6273.tmp 856 632E.tmp 1092 63AB.tmp 2576 6409.tmp 252 6467.tmp 2276 64C5.tmp 1408 6513.tmp 2680 6571.tmp 2136 65BF.tmp 2056 660D.tmp 3392 666B.tmp 4056 66B9.tmp 1748 6707.tmp 3764 6755.tmp 2424 67A3.tmp 4360 67F1.tmp 1352 684F.tmp 2788 68AD.tmp 1036 690A.tmp 4764 6968.tmp 1584 69B6.tmp 4512 6A14.tmp 1520 6A72.tmp 3788 6AD0.tmp 3400 6B2D.tmp 4796 6B8B.tmp 4520 6BE9.tmp 2224 6C37.tmp 1612 6C95.tmp 2648 6CF2.tmp 3756 6D50.tmp 4980 6DAE.tmp 452 6E0C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2400 1636 2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe 82 PID 1636 wrote to memory of 2400 1636 2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe 82 PID 1636 wrote to memory of 2400 1636 2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe 82 PID 2400 wrote to memory of 528 2400 54B7.tmp 83 PID 2400 wrote to memory of 528 2400 54B7.tmp 83 PID 2400 wrote to memory of 528 2400 54B7.tmp 83 PID 528 wrote to memory of 4856 528 5544.tmp 84 PID 528 wrote to memory of 4856 528 5544.tmp 84 PID 528 wrote to memory of 4856 528 5544.tmp 84 PID 4856 wrote to memory of 1408 4856 55C1.tmp 85 PID 4856 wrote to memory of 1408 4856 55C1.tmp 85 PID 4856 wrote to memory of 1408 4856 55C1.tmp 85 PID 1408 wrote to memory of 4536 1408 562E.tmp 86 PID 1408 wrote to memory of 4536 1408 562E.tmp 86 PID 1408 wrote to memory of 4536 1408 562E.tmp 86 PID 4536 wrote to memory of 2776 4536 569C.tmp 87 PID 4536 wrote to memory of 2776 4536 569C.tmp 87 PID 4536 wrote to memory of 2776 4536 569C.tmp 87 PID 2776 wrote to memory of 3772 2776 5719.tmp 88 PID 2776 wrote to memory of 3772 2776 5719.tmp 88 PID 2776 wrote to memory of 3772 2776 5719.tmp 88 PID 3772 wrote to memory of 3244 3772 5796.tmp 89 PID 3772 wrote to memory of 3244 3772 5796.tmp 89 PID 3772 wrote to memory of 3244 3772 5796.tmp 89 PID 3244 wrote to memory of 1008 3244 5803.tmp 90 PID 3244 wrote to memory of 1008 3244 5803.tmp 90 PID 3244 wrote to memory of 1008 3244 5803.tmp 90 PID 1008 wrote to memory of 112 1008 5880.tmp 93 PID 1008 wrote to memory of 112 1008 5880.tmp 93 PID 1008 wrote to memory of 112 1008 5880.tmp 93 PID 112 wrote to memory of 1352 112 58ED.tmp 95 PID 112 wrote to memory of 1352 112 58ED.tmp 95 PID 112 wrote to memory of 1352 112 58ED.tmp 95 PID 1352 wrote to memory of 2348 1352 595B.tmp 96 PID 1352 wrote to memory of 2348 1352 595B.tmp 96 PID 1352 wrote to memory of 2348 1352 595B.tmp 96 PID 2348 wrote to memory of 4284 2348 59C8.tmp 97 PID 2348 wrote to memory of 4284 2348 59C8.tmp 97 PID 2348 wrote to memory of 4284 2348 59C8.tmp 97 PID 4284 wrote to memory of 5004 4284 5A26.tmp 98 PID 4284 wrote to memory of 5004 4284 5A26.tmp 98 PID 4284 wrote to memory of 5004 4284 5A26.tmp 98 PID 5004 wrote to memory of 2068 5004 5A84.tmp 99 PID 5004 wrote to memory of 2068 5004 5A84.tmp 99 PID 5004 wrote to memory of 2068 5004 5A84.tmp 99 PID 2068 wrote to memory of 4672 2068 5AE1.tmp 100 PID 2068 wrote to memory of 4672 2068 5AE1.tmp 100 PID 2068 wrote to memory of 4672 2068 5AE1.tmp 100 PID 4672 wrote to memory of 4420 4672 5B5E.tmp 101 PID 4672 wrote to memory of 4420 4672 5B5E.tmp 101 PID 4672 wrote to memory of 4420 4672 5B5E.tmp 101 PID 4420 wrote to memory of 4516 4420 5BAD.tmp 104 PID 4420 wrote to memory of 4516 4420 5BAD.tmp 104 PID 4420 wrote to memory of 4516 4420 5BAD.tmp 104 PID 4516 wrote to memory of 4408 4516 5C1A.tmp 105 PID 4516 wrote to memory of 4408 4516 5C1A.tmp 105 PID 4516 wrote to memory of 4408 4516 5C1A.tmp 105 PID 4408 wrote to memory of 5060 4408 5C87.tmp 106 PID 4408 wrote to memory of 5060 4408 5C87.tmp 106 PID 4408 wrote to memory of 5060 4408 5C87.tmp 106 PID 5060 wrote to memory of 2292 5060 5CF5.tmp 107 PID 5060 wrote to memory of 2292 5060 5CF5.tmp 107 PID 5060 wrote to memory of 2292 5060 5CF5.tmp 107 PID 2292 wrote to memory of 1524 2292 5D81.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_0819a015d82314ad27531a3581545000_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"23⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"24⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"25⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"26⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"27⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"28⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"29⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"30⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"31⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"32⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"33⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"34⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"35⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"36⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"37⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"38⤵
- Executes dropped EXE
PID:252 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"39⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"40⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"41⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"42⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"43⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"44⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"45⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"46⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"47⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"48⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"49⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"50⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"51⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"52⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"53⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"54⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"55⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"56⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"57⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"58⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"59⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"60⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"61⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"62⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"63⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"64⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"65⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"66⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"67⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"68⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"69⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"71⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"72⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"73⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"74⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"75⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"76⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"77⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"78⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"79⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"80⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"81⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"82⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"83⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"84⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"85⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"86⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"87⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"88⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"89⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"90⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"91⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"92⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"93⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"95⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"96⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"97⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"98⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"99⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"100⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"101⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"102⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"103⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"104⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"105⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"106⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"107⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"108⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"109⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"110⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"111⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"112⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"113⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"114⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"115⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"116⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"117⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"118⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"119⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"120⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"121⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"122⤵PID:224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-