Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
-
Size
541KB
-
MD5
11a5b8d0f4117d0c79cd40b966c7b232
-
SHA1
f559bc17f135f4143064f1eea0a20383aa42127e
-
SHA256
cd2d28b0caca916c98472fc2a662a3c5dd4e40e9ef59027cdc286795242521b7
-
SHA512
1623069f93f141823d58ed3324e09abdee29e2682d96b3f84074694bed8e53997a355fcb03662081eaf052738f4755602f7b86e5ffcf916c252e85408278c63d
-
SSDEEP
12288:UU5rCOTeifr5vofVupT2hdRGmK706orZa73ctO:UUQOJflIVuh27RZT6orU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 876 4779.tmp 1620 47F6.tmp 4332 4853.tmp 3368 48E0.tmp 792 492E.tmp 1012 499C.tmp 4496 49F9.tmp 3008 4A67.tmp 2984 4AC4.tmp 1396 4B22.tmp 3180 4B70.tmp 2900 4BBE.tmp 2440 4C2C.tmp 3552 4C8A.tmp 224 4D07.tmp 1752 4D64.tmp 3308 4DB2.tmp 388 4E10.tmp 2460 4E6E.tmp 2104 4EBC.tmp 2728 4F1A.tmp 1740 4F68.tmp 4820 4FB6.tmp 4468 5014.tmp 1672 5091.tmp 4944 510E.tmp 1524 517B.tmp 4552 51C9.tmp 5116 5217.tmp 4460 5275.tmp 2580 52F2.tmp 4152 5360.tmp 1624 53CD.tmp 2316 541B.tmp 3576 5479.tmp 3684 54C7.tmp 2124 5515.tmp 3968 5563.tmp 376 55C1.tmp 4040 560F.tmp 848 565D.tmp 2308 56AB.tmp 1728 56F9.tmp 2240 5748.tmp 4824 57A5.tmp 3716 57F3.tmp 4004 5842.tmp 3616 589F.tmp 1364 58ED.tmp 4428 594B.tmp 2668 5999.tmp 2448 59F7.tmp 1560 5A55.tmp 1620 5AC2.tmp 400 5B20.tmp 1472 5B7E.tmp 3924 5BDB.tmp 1800 5C2A.tmp 772 5C78.tmp 792 5CD5.tmp 4992 5D24.tmp 4300 5D81.tmp 468 5DDF.tmp 4268 5E3D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 876 832 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 83 PID 832 wrote to memory of 876 832 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 83 PID 832 wrote to memory of 876 832 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 83 PID 876 wrote to memory of 1620 876 4779.tmp 84 PID 876 wrote to memory of 1620 876 4779.tmp 84 PID 876 wrote to memory of 1620 876 4779.tmp 84 PID 1620 wrote to memory of 4332 1620 47F6.tmp 85 PID 1620 wrote to memory of 4332 1620 47F6.tmp 85 PID 1620 wrote to memory of 4332 1620 47F6.tmp 85 PID 4332 wrote to memory of 3368 4332 4853.tmp 86 PID 4332 wrote to memory of 3368 4332 4853.tmp 86 PID 4332 wrote to memory of 3368 4332 4853.tmp 86 PID 3368 wrote to memory of 792 3368 48E0.tmp 87 PID 3368 wrote to memory of 792 3368 48E0.tmp 87 PID 3368 wrote to memory of 792 3368 48E0.tmp 87 PID 792 wrote to memory of 1012 792 492E.tmp 88 PID 792 wrote to memory of 1012 792 492E.tmp 88 PID 792 wrote to memory of 1012 792 492E.tmp 88 PID 1012 wrote to memory of 4496 1012 499C.tmp 89 PID 1012 wrote to memory of 4496 1012 499C.tmp 89 PID 1012 wrote to memory of 4496 1012 499C.tmp 89 PID 4496 wrote to memory of 3008 4496 49F9.tmp 90 PID 4496 wrote to memory of 3008 4496 49F9.tmp 90 PID 4496 wrote to memory of 3008 4496 49F9.tmp 90 PID 3008 wrote to memory of 2984 3008 4A67.tmp 91 PID 3008 wrote to memory of 2984 3008 4A67.tmp 91 PID 3008 wrote to memory of 2984 3008 4A67.tmp 91 PID 2984 wrote to memory of 1396 2984 4AC4.tmp 92 PID 2984 wrote to memory of 1396 2984 4AC4.tmp 92 PID 2984 wrote to memory of 1396 2984 4AC4.tmp 92 PID 1396 wrote to memory of 3180 1396 4B22.tmp 93 PID 1396 wrote to memory of 3180 1396 4B22.tmp 93 PID 1396 wrote to memory of 3180 1396 4B22.tmp 93 PID 3180 wrote to memory of 2900 3180 4B70.tmp 94 PID 3180 wrote to memory of 2900 3180 4B70.tmp 94 PID 3180 wrote to memory of 2900 3180 4B70.tmp 94 PID 2900 wrote to memory of 2440 2900 4BBE.tmp 95 PID 2900 wrote to memory of 2440 2900 4BBE.tmp 95 PID 2900 wrote to memory of 2440 2900 4BBE.tmp 95 PID 2440 wrote to memory of 3552 2440 4C2C.tmp 96 PID 2440 wrote to memory of 3552 2440 4C2C.tmp 96 PID 2440 wrote to memory of 3552 2440 4C2C.tmp 96 PID 3552 wrote to memory of 224 3552 4C8A.tmp 97 PID 3552 wrote to memory of 224 3552 4C8A.tmp 97 PID 3552 wrote to memory of 224 3552 4C8A.tmp 97 PID 224 wrote to memory of 1752 224 4D07.tmp 98 PID 224 wrote to memory of 1752 224 4D07.tmp 98 PID 224 wrote to memory of 1752 224 4D07.tmp 98 PID 1752 wrote to memory of 3308 1752 4D64.tmp 99 PID 1752 wrote to memory of 3308 1752 4D64.tmp 99 PID 1752 wrote to memory of 3308 1752 4D64.tmp 99 PID 3308 wrote to memory of 388 3308 4DB2.tmp 100 PID 3308 wrote to memory of 388 3308 4DB2.tmp 100 PID 3308 wrote to memory of 388 3308 4DB2.tmp 100 PID 388 wrote to memory of 2460 388 4E10.tmp 101 PID 388 wrote to memory of 2460 388 4E10.tmp 101 PID 388 wrote to memory of 2460 388 4E10.tmp 101 PID 2460 wrote to memory of 2104 2460 4E6E.tmp 102 PID 2460 wrote to memory of 2104 2460 4E6E.tmp 102 PID 2460 wrote to memory of 2104 2460 4E6E.tmp 102 PID 2104 wrote to memory of 2728 2104 4EBC.tmp 103 PID 2104 wrote to memory of 2728 2104 4EBC.tmp 103 PID 2104 wrote to memory of 2728 2104 4EBC.tmp 103 PID 2728 wrote to memory of 1740 2728 4F1A.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"23⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"24⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"25⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"26⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"27⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"28⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"29⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"30⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"31⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"32⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"33⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"34⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"35⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"36⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"37⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"38⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"39⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"40⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"41⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"42⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"43⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"44⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"45⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"46⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"47⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"48⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"49⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"50⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"51⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"52⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"53⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"54⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"55⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"56⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"57⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"58⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"59⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"60⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"61⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"62⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"63⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"64⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"65⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"66⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"68⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"69⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"70⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"71⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"72⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"73⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"74⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"75⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"76⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"78⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"79⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"80⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"81⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"82⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"83⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"84⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"85⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"86⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"88⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"89⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"90⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"91⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"92⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"93⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"94⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"95⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"96⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"97⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"98⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"99⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"100⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"101⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"102⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"103⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"104⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"105⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"106⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"107⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"108⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"109⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"110⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"111⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"112⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"113⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"114⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"115⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"116⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"117⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"119⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"120⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"121⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"122⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-