Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2024 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe
-
Size
486KB
-
MD5
90f52ec59fe056888d01e871f8761b7f
-
SHA1
6b7b9262fedd6139fd04880e341663e9e1d2374d
-
SHA256
f4b453bbb9e6490d059b10a15cd2c0cc44f2cf1292b7ece2cc32488bcd9907bc
-
SHA512
94d73b3550b85ac4db1530d03187865bb60da2baf34782e5b548dbe5fcfcaad2b2607aee77664b3d1630284c1ec5db37b0fe825bfbd28915f6dce85cba3d6f0c
-
SSDEEP
12288:/U5rCOTeiDLkrvtt28cxq95/V+AmcMUxaWxNZ:/UQOJDOj28cxq9JnMqJxN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1416 4546.tmp 800 45B4.tmp 4844 4611.tmp 5040 469E.tmp 3124 470B.tmp 3848 4779.tmp 964 47E6.tmp 4480 4844.tmp 764 4892.tmp 2036 48E0.tmp 4776 494D.tmp 2096 499C.tmp 4700 4A09.tmp 1872 4A76.tmp 4876 4B03.tmp 2968 4B90.tmp 3680 4C2C.tmp 4932 4C99.tmp 1848 4D16.tmp 1940 4D84.tmp 4508 4DF1.tmp 2548 4E5E.tmp 3212 4ECC.tmp 2804 4F1A.tmp 4716 4F68.tmp 1908 4FC6.tmp 556 5014.tmp 1028 5091.tmp 2692 50EF.tmp 3828 516C.tmp 2168 51D9.tmp 612 5246.tmp 1236 52C3.tmp 3100 5311.tmp 728 536F.tmp 4960 53BD.tmp 2360 541B.tmp 4664 5488.tmp 4896 54D7.tmp 1188 5534.tmp 3060 5592.tmp 4368 55F0.tmp 1852 563E.tmp 2124 569C.tmp 1016 56F9.tmp 2444 5757.tmp 2464 57B5.tmp 4336 5813.tmp 4968 5870.tmp 2640 58BF.tmp 4912 591C.tmp 1984 597A.tmp 2560 59D8.tmp 2104 5A36.tmp 5080 5A93.tmp 2172 5AF1.tmp 4492 5B4F.tmp 4796 5BAD.tmp 4760 5BFB.tmp 3076 5C68.tmp 2480 5CB6.tmp 4284 5D04.tmp 4272 5D62.tmp 4704 5DC0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 1416 4704 2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe 83 PID 4704 wrote to memory of 1416 4704 2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe 83 PID 4704 wrote to memory of 1416 4704 2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe 83 PID 1416 wrote to memory of 800 1416 4546.tmp 84 PID 1416 wrote to memory of 800 1416 4546.tmp 84 PID 1416 wrote to memory of 800 1416 4546.tmp 84 PID 800 wrote to memory of 4844 800 45B4.tmp 85 PID 800 wrote to memory of 4844 800 45B4.tmp 85 PID 800 wrote to memory of 4844 800 45B4.tmp 85 PID 4844 wrote to memory of 5040 4844 4611.tmp 86 PID 4844 wrote to memory of 5040 4844 4611.tmp 86 PID 4844 wrote to memory of 5040 4844 4611.tmp 86 PID 5040 wrote to memory of 3124 5040 469E.tmp 87 PID 5040 wrote to memory of 3124 5040 469E.tmp 87 PID 5040 wrote to memory of 3124 5040 469E.tmp 87 PID 3124 wrote to memory of 3848 3124 470B.tmp 88 PID 3124 wrote to memory of 3848 3124 470B.tmp 88 PID 3124 wrote to memory of 3848 3124 470B.tmp 88 PID 3848 wrote to memory of 964 3848 4779.tmp 89 PID 3848 wrote to memory of 964 3848 4779.tmp 89 PID 3848 wrote to memory of 964 3848 4779.tmp 89 PID 964 wrote to memory of 4480 964 47E6.tmp 90 PID 964 wrote to memory of 4480 964 47E6.tmp 90 PID 964 wrote to memory of 4480 964 47E6.tmp 90 PID 4480 wrote to memory of 764 4480 4844.tmp 91 PID 4480 wrote to memory of 764 4480 4844.tmp 91 PID 4480 wrote to memory of 764 4480 4844.tmp 91 PID 764 wrote to memory of 2036 764 4892.tmp 92 PID 764 wrote to memory of 2036 764 4892.tmp 92 PID 764 wrote to memory of 2036 764 4892.tmp 92 PID 2036 wrote to memory of 4776 2036 48E0.tmp 93 PID 2036 wrote to memory of 4776 2036 48E0.tmp 93 PID 2036 wrote to memory of 4776 2036 48E0.tmp 93 PID 4776 wrote to memory of 2096 4776 494D.tmp 94 PID 4776 wrote to memory of 2096 4776 494D.tmp 94 PID 4776 wrote to memory of 2096 4776 494D.tmp 94 PID 2096 wrote to memory of 4700 2096 499C.tmp 95 PID 2096 wrote to memory of 4700 2096 499C.tmp 95 PID 2096 wrote to memory of 4700 2096 499C.tmp 95 PID 4700 wrote to memory of 1872 4700 4A09.tmp 96 PID 4700 wrote to memory of 1872 4700 4A09.tmp 96 PID 4700 wrote to memory of 1872 4700 4A09.tmp 96 PID 1872 wrote to memory of 4876 1872 4A76.tmp 97 PID 1872 wrote to memory of 4876 1872 4A76.tmp 97 PID 1872 wrote to memory of 4876 1872 4A76.tmp 97 PID 4876 wrote to memory of 2968 4876 4B03.tmp 98 PID 4876 wrote to memory of 2968 4876 4B03.tmp 98 PID 4876 wrote to memory of 2968 4876 4B03.tmp 98 PID 2968 wrote to memory of 3680 2968 4B90.tmp 99 PID 2968 wrote to memory of 3680 2968 4B90.tmp 99 PID 2968 wrote to memory of 3680 2968 4B90.tmp 99 PID 3680 wrote to memory of 4932 3680 4C2C.tmp 100 PID 3680 wrote to memory of 4932 3680 4C2C.tmp 100 PID 3680 wrote to memory of 4932 3680 4C2C.tmp 100 PID 4932 wrote to memory of 1848 4932 4C99.tmp 101 PID 4932 wrote to memory of 1848 4932 4C99.tmp 101 PID 4932 wrote to memory of 1848 4932 4C99.tmp 101 PID 1848 wrote to memory of 1940 1848 4D16.tmp 102 PID 1848 wrote to memory of 1940 1848 4D16.tmp 102 PID 1848 wrote to memory of 1940 1848 4D16.tmp 102 PID 1940 wrote to memory of 4508 1940 4D84.tmp 103 PID 1940 wrote to memory of 4508 1940 4D84.tmp 103 PID 1940 wrote to memory of 4508 1940 4D84.tmp 103 PID 4508 wrote to memory of 2548 4508 4DF1.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_90f52ec59fe056888d01e871f8761b7f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"23⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"24⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"25⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"26⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"27⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"28⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"29⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"30⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"31⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"32⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"33⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"34⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"35⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"36⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"37⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"38⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"39⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"40⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"41⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"42⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"43⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"44⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"45⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"46⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"47⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"48⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"49⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"50⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"51⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"52⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"53⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"54⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"55⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"56⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"57⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"58⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"59⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"60⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"61⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"62⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"63⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"64⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"65⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"66⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"67⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"68⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"69⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"70⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"71⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"72⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"73⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"74⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"75⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"76⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"77⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"78⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"79⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"80⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"81⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"82⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"83⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"84⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"85⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"86⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"87⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"88⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"89⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"90⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"91⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"92⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"93⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"94⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"96⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"97⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"98⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"99⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"100⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"101⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"102⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"103⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"104⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"105⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"106⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"107⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"108⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"109⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"110⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"111⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"112⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"113⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"114⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"115⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"116⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"117⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"118⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"119⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"120⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"121⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-