Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe
-
Size
765KB
-
MD5
0b73bc52ebeb36117a4ece4db6fe6264
-
SHA1
59cf4666f6029baa0ad3bf52ac68bff6121e8ad9
-
SHA256
a87c829c0684e1d15041900eb81fdb53ad4aa4244ff3b87a6f61c554b8c9b869
-
SHA512
9ebadb2a8cc696906e349d9ff397318110c72e739a1bb263f05685b789ea7aa8cd1ec64046fe46e2b9dbb11e1aebd3e3a0eed9cbdf0cc4f9bd85019a76d8530b
-
SSDEEP
12288:ZU5rCOTeiDfH0SvRUxj12pR3ZF5rn5rLOa54U5w5A:ZUQOJDv0Sp41u3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2020 4FC6.tmp 4828 5072.tmp 748 512D.tmp 4200 5227.tmp 2232 52F2.tmp 4612 539E.tmp 4744 5469.tmp 4380 54F6.tmp 884 5592.tmp 3988 561F.tmp 3292 56CB.tmp 4636 5767.tmp 3412 5813.tmp 2164 58CE.tmp 2732 5999.tmp 4968 5A55.tmp 4396 5AF1.tmp 1308 5BAD.tmp 2312 5C49.tmp 3916 5CB6.tmp 3560 5D43.tmp 3832 5E0E.tmp 4048 5ED9.tmp 2992 5F66.tmp 2980 5FE3.tmp 1280 608F.tmp 3356 613A.tmp 2204 61D7.tmp 3492 6283.tmp 4940 631F.tmp 4136 639C.tmp 1752 6448.tmp 4300 64D4.tmp 4320 6532.tmp 2836 6580.tmp 2984 65DE.tmp 3612 664B.tmp 1152 6699.tmp 5052 6707.tmp 3020 6774.tmp 1892 67D2.tmp 2476 6830.tmp 4744 688D.tmp 2560 68EB.tmp 548 6959.tmp 4988 69C6.tmp 4008 6A24.tmp 828 6A81.tmp 4188 6AEF.tmp 1240 6B5C.tmp 1368 6BCA.tmp 3264 6C37.tmp 5016 6C95.tmp 3660 6CF2.tmp 3556 6D60.tmp 1064 6DCD.tmp 4968 6E3B.tmp 2944 6EA8.tmp 3580 6F15.tmp 5044 6F73.tmp 3396 6FC1.tmp 532 702F.tmp 3468 708C.tmp 1656 70EA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2020 2836 2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe 83 PID 2836 wrote to memory of 2020 2836 2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe 83 PID 2836 wrote to memory of 2020 2836 2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe 83 PID 2020 wrote to memory of 4828 2020 4FC6.tmp 84 PID 2020 wrote to memory of 4828 2020 4FC6.tmp 84 PID 2020 wrote to memory of 4828 2020 4FC6.tmp 84 PID 4828 wrote to memory of 748 4828 5072.tmp 85 PID 4828 wrote to memory of 748 4828 5072.tmp 85 PID 4828 wrote to memory of 748 4828 5072.tmp 85 PID 748 wrote to memory of 4200 748 512D.tmp 87 PID 748 wrote to memory of 4200 748 512D.tmp 87 PID 748 wrote to memory of 4200 748 512D.tmp 87 PID 4200 wrote to memory of 2232 4200 5227.tmp 89 PID 4200 wrote to memory of 2232 4200 5227.tmp 89 PID 4200 wrote to memory of 2232 4200 5227.tmp 89 PID 2232 wrote to memory of 4612 2232 52F2.tmp 91 PID 2232 wrote to memory of 4612 2232 52F2.tmp 91 PID 2232 wrote to memory of 4612 2232 52F2.tmp 91 PID 4612 wrote to memory of 4744 4612 539E.tmp 92 PID 4612 wrote to memory of 4744 4612 539E.tmp 92 PID 4612 wrote to memory of 4744 4612 539E.tmp 92 PID 4744 wrote to memory of 4380 4744 5469.tmp 93 PID 4744 wrote to memory of 4380 4744 5469.tmp 93 PID 4744 wrote to memory of 4380 4744 5469.tmp 93 PID 4380 wrote to memory of 884 4380 54F6.tmp 94 PID 4380 wrote to memory of 884 4380 54F6.tmp 94 PID 4380 wrote to memory of 884 4380 54F6.tmp 94 PID 884 wrote to memory of 3988 884 5592.tmp 95 PID 884 wrote to memory of 3988 884 5592.tmp 95 PID 884 wrote to memory of 3988 884 5592.tmp 95 PID 3988 wrote to memory of 3292 3988 561F.tmp 96 PID 3988 wrote to memory of 3292 3988 561F.tmp 96 PID 3988 wrote to memory of 3292 3988 561F.tmp 96 PID 3292 wrote to memory of 4636 3292 56CB.tmp 98 PID 3292 wrote to memory of 4636 3292 56CB.tmp 98 PID 3292 wrote to memory of 4636 3292 56CB.tmp 98 PID 4636 wrote to memory of 3412 4636 5767.tmp 99 PID 4636 wrote to memory of 3412 4636 5767.tmp 99 PID 4636 wrote to memory of 3412 4636 5767.tmp 99 PID 3412 wrote to memory of 2164 3412 5813.tmp 100 PID 3412 wrote to memory of 2164 3412 5813.tmp 100 PID 3412 wrote to memory of 2164 3412 5813.tmp 100 PID 2164 wrote to memory of 2732 2164 58CE.tmp 101 PID 2164 wrote to memory of 2732 2164 58CE.tmp 101 PID 2164 wrote to memory of 2732 2164 58CE.tmp 101 PID 2732 wrote to memory of 4968 2732 5999.tmp 102 PID 2732 wrote to memory of 4968 2732 5999.tmp 102 PID 2732 wrote to memory of 4968 2732 5999.tmp 102 PID 4968 wrote to memory of 4396 4968 5A55.tmp 103 PID 4968 wrote to memory of 4396 4968 5A55.tmp 103 PID 4968 wrote to memory of 4396 4968 5A55.tmp 103 PID 4396 wrote to memory of 1308 4396 5AF1.tmp 104 PID 4396 wrote to memory of 1308 4396 5AF1.tmp 104 PID 4396 wrote to memory of 1308 4396 5AF1.tmp 104 PID 1308 wrote to memory of 2312 1308 5BAD.tmp 105 PID 1308 wrote to memory of 2312 1308 5BAD.tmp 105 PID 1308 wrote to memory of 2312 1308 5BAD.tmp 105 PID 2312 wrote to memory of 3916 2312 5C49.tmp 106 PID 2312 wrote to memory of 3916 2312 5C49.tmp 106 PID 2312 wrote to memory of 3916 2312 5C49.tmp 106 PID 3916 wrote to memory of 3560 3916 5CB6.tmp 107 PID 3916 wrote to memory of 3560 3916 5CB6.tmp 107 PID 3916 wrote to memory of 3560 3916 5CB6.tmp 107 PID 3560 wrote to memory of 3832 3560 5D43.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_0b73bc52ebeb36117a4ece4db6fe6264_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"23⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"24⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"25⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"26⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"27⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"28⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"29⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"30⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"31⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"32⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"33⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"34⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"35⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"36⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"37⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"38⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"39⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"40⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"41⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"42⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"43⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"44⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"45⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"46⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"47⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"48⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"49⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"50⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"51⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"52⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"53⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"54⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"55⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"56⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"57⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"58⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"59⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"60⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"61⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"62⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"63⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"64⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"65⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"66⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"67⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"68⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"69⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"70⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"71⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"72⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"73⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"74⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"75⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"76⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"77⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"78⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"79⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"80⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"81⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"82⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"83⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"84⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"85⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"86⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"87⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"88⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"89⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"90⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"91⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"92⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"93⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"94⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"95⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"96⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"98⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"99⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"100⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"101⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"102⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"103⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"104⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"105⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"106⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"107⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"108⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"109⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"110⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"111⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"112⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"113⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"114⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"115⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"116⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"117⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"118⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"119⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"120⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"121⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"122⤵PID:3568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-