Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2024, 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe
-
Size
541KB
-
MD5
27ef19b749c299a16bcbfa23100820c4
-
SHA1
5cad264dee478e0092d3b249f2146fbbb645f189
-
SHA256
e66c97566607df11cc01128bf6b6398bd182e39a60cbd4e481e12906dccdbf8d
-
SHA512
d5f2e35bd307f3573b8ccb4ba2a8f4082e5a4cdfac9dacc79e040a94d587d59957f173084e6b8b496b470da6baacedca26769895e21e6efc89be9a2496e959db
-
SSDEEP
12288:UU5rCOTeifHTAdeDWyGIzRmVe4iZbvYrZa73ctO:UUQOJfHUdrlSAg4iRYrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3624 46BD.tmp 4936 472B.tmp 2420 4779.tmp 1188 47D6.tmp 2216 4863.tmp 4668 48B1.tmp 2244 491F.tmp 4884 496D.tmp 632 49BB.tmp 4380 4A19.tmp 4328 4A86.tmp 1400 4AF3.tmp 4784 4B51.tmp 2016 4BAF.tmp 364 4C0D.tmp 4324 4C7A.tmp 400 4CF7.tmp 3120 4D45.tmp 5060 4DA3.tmp 724 4E10.tmp 3184 4E6E.tmp 2144 4EDB.tmp 244 4F39.tmp 4852 4FA6.tmp 3288 518B.tmp 2020 51F8.tmp 620 5256.tmp 3708 52D3.tmp 404 5340.tmp 2528 539E.tmp 2260 541B.tmp 1556 5469.tmp 4032 54C7.tmp 1436 5515.tmp 3940 5573.tmp 1420 55C1.tmp 2336 560F.tmp 4820 566D.tmp 3160 56CB.tmp 5068 5728.tmp 1316 5776.tmp 3340 57D4.tmp 2236 5822.tmp 3500 5880.tmp 2284 58CE.tmp 4296 592C.tmp 2428 597A.tmp 3424 59C8.tmp 2960 5A26.tmp 2380 5A84.tmp 2704 5AD2.tmp 4188 5B30.tmp 644 5B7E.tmp 3368 5BCC.tmp 2520 5C2A.tmp 1424 5C78.tmp 976 5D14.tmp 4580 5D72.tmp 2008 5DC0.tmp 4936 5E0E.tmp 3824 5E5C.tmp 5016 5EAA.tmp 1188 5EF8.tmp 2620 5F46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 3624 2288 2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe 85 PID 2288 wrote to memory of 3624 2288 2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe 85 PID 2288 wrote to memory of 3624 2288 2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe 85 PID 3624 wrote to memory of 4936 3624 46BD.tmp 86 PID 3624 wrote to memory of 4936 3624 46BD.tmp 86 PID 3624 wrote to memory of 4936 3624 46BD.tmp 86 PID 4936 wrote to memory of 2420 4936 472B.tmp 87 PID 4936 wrote to memory of 2420 4936 472B.tmp 87 PID 4936 wrote to memory of 2420 4936 472B.tmp 87 PID 2420 wrote to memory of 1188 2420 4779.tmp 88 PID 2420 wrote to memory of 1188 2420 4779.tmp 88 PID 2420 wrote to memory of 1188 2420 4779.tmp 88 PID 1188 wrote to memory of 2216 1188 47D6.tmp 89 PID 1188 wrote to memory of 2216 1188 47D6.tmp 89 PID 1188 wrote to memory of 2216 1188 47D6.tmp 89 PID 2216 wrote to memory of 4668 2216 4863.tmp 90 PID 2216 wrote to memory of 4668 2216 4863.tmp 90 PID 2216 wrote to memory of 4668 2216 4863.tmp 90 PID 4668 wrote to memory of 2244 4668 48B1.tmp 91 PID 4668 wrote to memory of 2244 4668 48B1.tmp 91 PID 4668 wrote to memory of 2244 4668 48B1.tmp 91 PID 2244 wrote to memory of 4884 2244 491F.tmp 92 PID 2244 wrote to memory of 4884 2244 491F.tmp 92 PID 2244 wrote to memory of 4884 2244 491F.tmp 92 PID 4884 wrote to memory of 632 4884 496D.tmp 93 PID 4884 wrote to memory of 632 4884 496D.tmp 93 PID 4884 wrote to memory of 632 4884 496D.tmp 93 PID 632 wrote to memory of 4380 632 49BB.tmp 94 PID 632 wrote to memory of 4380 632 49BB.tmp 94 PID 632 wrote to memory of 4380 632 49BB.tmp 94 PID 4380 wrote to memory of 4328 4380 4A19.tmp 95 PID 4380 wrote to memory of 4328 4380 4A19.tmp 95 PID 4380 wrote to memory of 4328 4380 4A19.tmp 95 PID 4328 wrote to memory of 1400 4328 4A86.tmp 96 PID 4328 wrote to memory of 1400 4328 4A86.tmp 96 PID 4328 wrote to memory of 1400 4328 4A86.tmp 96 PID 1400 wrote to memory of 4784 1400 4AF3.tmp 97 PID 1400 wrote to memory of 4784 1400 4AF3.tmp 97 PID 1400 wrote to memory of 4784 1400 4AF3.tmp 97 PID 4784 wrote to memory of 2016 4784 4B51.tmp 98 PID 4784 wrote to memory of 2016 4784 4B51.tmp 98 PID 4784 wrote to memory of 2016 4784 4B51.tmp 98 PID 2016 wrote to memory of 364 2016 4BAF.tmp 99 PID 2016 wrote to memory of 364 2016 4BAF.tmp 99 PID 2016 wrote to memory of 364 2016 4BAF.tmp 99 PID 364 wrote to memory of 4324 364 4C0D.tmp 100 PID 364 wrote to memory of 4324 364 4C0D.tmp 100 PID 364 wrote to memory of 4324 364 4C0D.tmp 100 PID 4324 wrote to memory of 400 4324 4C7A.tmp 101 PID 4324 wrote to memory of 400 4324 4C7A.tmp 101 PID 4324 wrote to memory of 400 4324 4C7A.tmp 101 PID 400 wrote to memory of 3120 400 4CF7.tmp 102 PID 400 wrote to memory of 3120 400 4CF7.tmp 102 PID 400 wrote to memory of 3120 400 4CF7.tmp 102 PID 3120 wrote to memory of 5060 3120 4D45.tmp 103 PID 3120 wrote to memory of 5060 3120 4D45.tmp 103 PID 3120 wrote to memory of 5060 3120 4D45.tmp 103 PID 5060 wrote to memory of 724 5060 4DA3.tmp 104 PID 5060 wrote to memory of 724 5060 4DA3.tmp 104 PID 5060 wrote to memory of 724 5060 4DA3.tmp 104 PID 724 wrote to memory of 3184 724 4E10.tmp 105 PID 724 wrote to memory of 3184 724 4E10.tmp 105 PID 724 wrote to memory of 3184 724 4E10.tmp 105 PID 3184 wrote to memory of 2144 3184 4E6E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_27ef19b749c299a16bcbfa23100820c4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"23⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"24⤵
- Executes dropped EXE
PID:244 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"25⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"26⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"27⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"28⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"29⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"30⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"31⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"32⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"33⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"34⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"35⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"36⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"37⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"38⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"39⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"40⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"41⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"42⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"43⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"44⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"45⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"46⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"47⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"48⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"49⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"50⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"51⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"52⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"53⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"54⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"55⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"56⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"57⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"58⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"59⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"60⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"61⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"62⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"63⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"64⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"65⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"66⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"67⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"68⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"69⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"70⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"71⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"72⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"73⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"74⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"75⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"76⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"77⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"78⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"79⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"80⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"81⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"82⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"83⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"84⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"85⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"86⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"87⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"88⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"89⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"90⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"91⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"92⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"93⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"94⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"95⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"96⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"97⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"98⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"99⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"100⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"101⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"102⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"103⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"104⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"105⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"106⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"107⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"108⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"109⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"110⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"111⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"112⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"113⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"114⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"115⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"116⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"117⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"118⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"119⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"120⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"121⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-