Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe
- Size 530KB
- Sample240602-hjvataef38
- SHA256 5f9a45e0088bdbacec31528d3c291abe9ed82ce903861b2a155ae3ad6544a738
- MD5 4a7580b6c9b6405ae9fb18b08f6aacac
- SHA1 e3a5b2ef1f294e563b5aa47a2e9fdcef179d799b
- SHA512 681f439da257b2dec8657fead85d04fbd2823d54980bf7ffa0fd8900eda2350a6e0200598c2ff8db05c0f2db735208b5549bff76ff3b3f976839517e49c4e57b
- SSDEEP 12288:AU5rCOTeioPs0X/T5Rzdwz3vusFKwOBDcNZulFVg0M1:AUQOJoPs0X75Az3vPF1qcNclFV/M1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 232 561F.tmp 944 567C.tmp 1972 56F9.tmp 2540 5796.tmp 2108 57F3.tmp 4456 5880.tmp 1324 590D.tmp 5004 59A9.tmp 1672 5A16.tmp 2008 5A93.tmp 3680 5B10.tmp 3684 5B9D.tmp 2688 5BFB.tmp 1996 5C68.tmp 4508 5D14.tmp 1308 5D62.tmp 2240 5DDF.tmp 1272 5E4C.tmp 1276 5EBA.tmp 1256 5F27.tmp 4848 5F95.tmp 3216 6021.tmp 3964 609E.tmp 5096 60FC.tmp 1656 615A.tmp 3780 61D7.tmp 4896 6254.tmp 3048 62B1.tmp 4480 631F.tmp 4280 638C.tmp 4900 63FA.tmp 2000 6457.tmp 4968 64F4.tmp 4524 6551.tmp 4292 65AF.tmp 2100 660D.tmp 224 666B.tmp 4208 66C8.tmp 4124 6726.tmp 1268 6774.tmp 1004 67D2.tmp 4268 6830.tmp 4672 688D.tmp 3196 68EB.tmp 1952 6939.tmp 812 6987.tmp 3948 69E5.tmp 1896 6A43.tmp 4832 6A91.tmp 3492 6AEF.tmp 3512 6B4D.tmp 2068 6BAA.tmp 4884 6C08.tmp 1616 6C56.tmp 3672 6CB4.tmp 5060 6D02.tmp 2192 6D60.tmp 492 6DAE.tmp 4752 6E0C.tmp 552 6E5A.tmp 1440 6EB8.tmp 2240 6F15.tmp 712 6F73.tmp 4052 6FD1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 232 2100 2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe 83 PID 2100 wrote to memory of 232 2100 2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe 83 PID 2100 wrote to memory of 232 2100 2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe 83 PID 232 wrote to memory of 944 232 561F.tmp 84 PID 232 wrote to memory of 944 232 561F.tmp 84 PID 232 wrote to memory of 944 232 561F.tmp 84 PID 944 wrote to memory of 1972 944 567C.tmp 85 PID 944 wrote to memory of 1972 944 567C.tmp 85 PID 944 wrote to memory of 1972 944 567C.tmp 85 PID 1972 wrote to memory of 2540 1972 56F9.tmp 86 PID 1972 wrote to memory of 2540 1972 56F9.tmp 86 PID 1972 wrote to memory of 2540 1972 56F9.tmp 86 PID 2540 wrote to memory of 2108 2540 5796.tmp 87 PID 2540 wrote to memory of 2108 2540 5796.tmp 87 PID 2540 wrote to memory of 2108 2540 5796.tmp 87 PID 2108 wrote to memory of 4456 2108 57F3.tmp 89 PID 2108 wrote to memory of 4456 2108 57F3.tmp 89 PID 2108 wrote to memory of 4456 2108 57F3.tmp 89 PID 4456 wrote to memory of 1324 4456 5880.tmp 90 PID 4456 wrote to memory of 1324 4456 5880.tmp 90 PID 4456 wrote to memory of 1324 4456 5880.tmp 90 PID 1324 wrote to memory of 5004 1324 590D.tmp 91 PID 1324 wrote to memory of 5004 1324 590D.tmp 91 PID 1324 wrote to memory of 5004 1324 590D.tmp 91 PID 5004 wrote to memory of 1672 5004 59A9.tmp 93 PID 5004 wrote to memory of 1672 5004 59A9.tmp 93 PID 5004 wrote to memory of 1672 5004 59A9.tmp 93 PID 1672 wrote to memory of 2008 1672 5A16.tmp 94 PID 1672 wrote to memory of 2008 1672 5A16.tmp 94 PID 1672 wrote to memory of 2008 1672 5A16.tmp 94 PID 2008 wrote to memory of 3680 2008 5A93.tmp 96 PID 2008 wrote to memory of 3680 2008 5A93.tmp 96 PID 2008 wrote to memory of 3680 2008 5A93.tmp 96 PID 3680 wrote to memory of 3684 3680 5B10.tmp 97 PID 3680 wrote to memory of 3684 3680 5B10.tmp 97 PID 3680 wrote to memory of 3684 3680 5B10.tmp 97 PID 3684 wrote to memory of 2688 3684 5B9D.tmp 98 PID 3684 wrote to memory of 2688 3684 5B9D.tmp 98 PID 3684 wrote to memory of 2688 3684 5B9D.tmp 98 PID 2688 wrote to memory of 1996 2688 5BFB.tmp 99 PID 2688 wrote to memory of 1996 2688 5BFB.tmp 99 PID 2688 wrote to memory of 1996 2688 5BFB.tmp 99 PID 1996 wrote to memory of 4508 1996 5C68.tmp 100 PID 1996 wrote to memory of 4508 1996 5C68.tmp 100 PID 1996 wrote to memory of 4508 1996 5C68.tmp 100 PID 4508 wrote to memory of 1308 4508 5D14.tmp 101 PID 4508 wrote to memory of 1308 4508 5D14.tmp 101 PID 4508 wrote to memory of 1308 4508 5D14.tmp 101 PID 1308 wrote to memory of 2240 1308 5D62.tmp 102 PID 1308 wrote to memory of 2240 1308 5D62.tmp 102 PID 1308 wrote to memory of 2240 1308 5D62.tmp 102 PID 2240 wrote to memory of 1272 2240 5DDF.tmp 103 PID 2240 wrote to memory of 1272 2240 5DDF.tmp 103 PID 2240 wrote to memory of 1272 2240 5DDF.tmp 103 PID 1272 wrote to memory of 1276 1272 5E4C.tmp 106 PID 1272 wrote to memory of 1276 1272 5E4C.tmp 106 PID 1272 wrote to memory of 1276 1272 5E4C.tmp 106 PID 1276 wrote to memory of 1256 1276 5EBA.tmp 107 PID 1276 wrote to memory of 1256 1276 5EBA.tmp 107 PID 1276 wrote to memory of 1256 1276 5EBA.tmp 107 PID 1256 wrote to memory of 4848 1256 5F27.tmp 108 PID 1256 wrote to memory of 4848 1256 5F27.tmp 108 PID 1256 wrote to memory of 4848 1256 5F27.tmp 108 PID 4848 wrote to memory of 3216 4848 5F95.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_4a7580b6c9b6405ae9fb18b08f6aacac_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"23⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"24⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"25⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"26⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"27⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"28⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"29⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"30⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"31⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"32⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"33⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"34⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"35⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"36⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"37⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"38⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"39⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"40⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"41⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"42⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"43⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"44⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"45⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"46⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"47⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"48⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"49⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"50⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"51⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"52⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"53⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"54⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"55⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"56⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"57⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"58⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"59⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"60⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"61⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"62⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"63⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"64⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"65⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"66⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"67⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"68⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"69⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"70⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"71⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"72⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"73⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"74⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"75⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"76⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"77⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"78⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"79⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"80⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"81⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"82⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"83⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"84⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"85⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"86⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"87⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"88⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"89⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"90⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"91⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"92⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"93⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"94⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"95⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"96⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"97⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"98⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"99⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"100⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"101⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"102⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"103⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"104⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"105⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"107⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"108⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"109⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"110⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"112⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"113⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"114⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"115⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"116⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"117⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"118⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"119⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"120⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"121⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"122⤵PID:4712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-