Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe
-
Size
486KB
-
MD5
e21e6a797b68981502687cdd47c27635
-
SHA1
3c586d3fe2178bc147bada820811f0e5b53c9aa2
-
SHA256
0893f5784e8c9c1a34c1dd93c550d96760ca1c6bdf883823087e28dbaf5d816d
-
SHA512
e6aaf8949651b19f5b323ba3a349f345af09fa22d60e69e118522c13c2d7dcfd10b988413f1a2951e7400bbd77bd004ab5ac9d4fdce0807b2db081bf53fc928c
-
SSDEEP
12288:/U5rCOTeiD/bHqqsJg8hrD/OfkTGCw13LNZ:/UQOJD/LnsJThrbrTi13LN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1584 4517.tmp 2936 4594.tmp 3500 4611.tmp 4716 468E.tmp 3896 46DC.tmp 2028 4759.tmp 816 47B7.tmp 4640 4805.tmp 2044 4853.tmp 3656 48B1.tmp 4276 490F.tmp 2244 497C.tmp 4844 49EA.tmp 4212 4A38.tmp 2924 4A96.tmp 5068 4AE4.tmp 5064 4B32.tmp 4464 4B90.tmp 4516 4C1C.tmp 4376 4C8A.tmp 3124 4CD8.tmp 3712 4D35.tmp 2300 4DA3.tmp 4960 4E01.tmp 3148 4E9D.tmp 2888 4F1A.tmp 2176 4F68.tmp 2500 4FD5.tmp 3400 5052.tmp 4260 50C0.tmp 4752 512D.tmp 3976 519A.tmp 3492 51E9.tmp 3260 5256.tmp 2248 52B4.tmp 868 5302.tmp 3112 5350.tmp 2240 53AE.tmp 3952 53FC.tmp 4340 545A.tmp 4648 54B7.tmp 512 5505.tmp 2084 5563.tmp 1392 55C1.tmp 3500 561F.tmp 1364 567C.tmp 4956 56DA.tmp 608 5738.tmp 4916 5786.tmp 4420 57E4.tmp 1652 5832.tmp 1356 5890.tmp 2892 58ED.tmp 4520 594B.tmp 4892 59A9.tmp 3656 5A07.tmp 2108 5A64.tmp 4076 5AC2.tmp 2788 5B20.tmp 4844 5B7E.tmp 3784 5BCC.tmp 4760 5C1A.tmp 2364 5C68.tmp 4328 5CC6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1584 2440 2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe 85 PID 2440 wrote to memory of 1584 2440 2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe 85 PID 2440 wrote to memory of 1584 2440 2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe 85 PID 1584 wrote to memory of 2936 1584 4517.tmp 87 PID 1584 wrote to memory of 2936 1584 4517.tmp 87 PID 1584 wrote to memory of 2936 1584 4517.tmp 87 PID 2936 wrote to memory of 3500 2936 4594.tmp 89 PID 2936 wrote to memory of 3500 2936 4594.tmp 89 PID 2936 wrote to memory of 3500 2936 4594.tmp 89 PID 3500 wrote to memory of 4716 3500 4611.tmp 91 PID 3500 wrote to memory of 4716 3500 4611.tmp 91 PID 3500 wrote to memory of 4716 3500 4611.tmp 91 PID 4716 wrote to memory of 3896 4716 468E.tmp 92 PID 4716 wrote to memory of 3896 4716 468E.tmp 92 PID 4716 wrote to memory of 3896 4716 468E.tmp 92 PID 3896 wrote to memory of 2028 3896 46DC.tmp 93 PID 3896 wrote to memory of 2028 3896 46DC.tmp 93 PID 3896 wrote to memory of 2028 3896 46DC.tmp 93 PID 2028 wrote to memory of 816 2028 4759.tmp 94 PID 2028 wrote to memory of 816 2028 4759.tmp 94 PID 2028 wrote to memory of 816 2028 4759.tmp 94 PID 816 wrote to memory of 4640 816 47B7.tmp 95 PID 816 wrote to memory of 4640 816 47B7.tmp 95 PID 816 wrote to memory of 4640 816 47B7.tmp 95 PID 4640 wrote to memory of 2044 4640 4805.tmp 96 PID 4640 wrote to memory of 2044 4640 4805.tmp 96 PID 4640 wrote to memory of 2044 4640 4805.tmp 96 PID 2044 wrote to memory of 3656 2044 4853.tmp 97 PID 2044 wrote to memory of 3656 2044 4853.tmp 97 PID 2044 wrote to memory of 3656 2044 4853.tmp 97 PID 3656 wrote to memory of 4276 3656 48B1.tmp 98 PID 3656 wrote to memory of 4276 3656 48B1.tmp 98 PID 3656 wrote to memory of 4276 3656 48B1.tmp 98 PID 4276 wrote to memory of 2244 4276 490F.tmp 99 PID 4276 wrote to memory of 2244 4276 490F.tmp 99 PID 4276 wrote to memory of 2244 4276 490F.tmp 99 PID 2244 wrote to memory of 4844 2244 497C.tmp 100 PID 2244 wrote to memory of 4844 2244 497C.tmp 100 PID 2244 wrote to memory of 4844 2244 497C.tmp 100 PID 4844 wrote to memory of 4212 4844 49EA.tmp 101 PID 4844 wrote to memory of 4212 4844 49EA.tmp 101 PID 4844 wrote to memory of 4212 4844 49EA.tmp 101 PID 4212 wrote to memory of 2924 4212 4A38.tmp 102 PID 4212 wrote to memory of 2924 4212 4A38.tmp 102 PID 4212 wrote to memory of 2924 4212 4A38.tmp 102 PID 2924 wrote to memory of 5068 2924 4A96.tmp 103 PID 2924 wrote to memory of 5068 2924 4A96.tmp 103 PID 2924 wrote to memory of 5068 2924 4A96.tmp 103 PID 5068 wrote to memory of 5064 5068 4AE4.tmp 104 PID 5068 wrote to memory of 5064 5068 4AE4.tmp 104 PID 5068 wrote to memory of 5064 5068 4AE4.tmp 104 PID 5064 wrote to memory of 4464 5064 4B32.tmp 105 PID 5064 wrote to memory of 4464 5064 4B32.tmp 105 PID 5064 wrote to memory of 4464 5064 4B32.tmp 105 PID 4464 wrote to memory of 4516 4464 4B90.tmp 107 PID 4464 wrote to memory of 4516 4464 4B90.tmp 107 PID 4464 wrote to memory of 4516 4464 4B90.tmp 107 PID 4516 wrote to memory of 4376 4516 4C1C.tmp 108 PID 4516 wrote to memory of 4376 4516 4C1C.tmp 108 PID 4516 wrote to memory of 4376 4516 4C1C.tmp 108 PID 4376 wrote to memory of 3124 4376 4C8A.tmp 109 PID 4376 wrote to memory of 3124 4376 4C8A.tmp 109 PID 4376 wrote to memory of 3124 4376 4C8A.tmp 109 PID 3124 wrote to memory of 3712 3124 4CD8.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_e21e6a797b68981502687cdd47c27635_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"23⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"24⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"25⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"26⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"27⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"28⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"29⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"30⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"31⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"32⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"33⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"34⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"35⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"36⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"37⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"38⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"39⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"40⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"41⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"42⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"43⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"44⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"45⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"46⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"47⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"48⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"49⤵
- Executes dropped EXE
PID:608 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"50⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"51⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"52⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"53⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"54⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"55⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"56⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"57⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"58⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"59⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"60⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"61⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"62⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"63⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"64⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"65⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"66⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"67⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"68⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"70⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"71⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"72⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"73⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"74⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"75⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"76⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"77⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"78⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"79⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"80⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"81⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"82⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"83⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"84⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"85⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"86⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"87⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"88⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"89⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"90⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"91⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"92⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"93⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"94⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"95⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"96⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"97⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"98⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"99⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"100⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"101⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"103⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"104⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"105⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"106⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"107⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"108⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"109⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"110⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"111⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"112⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"113⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"114⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"115⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"116⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"117⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"118⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"120⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"121⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"122⤵PID:4660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-