Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 16:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe
-
Size
488KB
-
MD5
0f77a1e997a728cab896c3ef42e0f882
-
SHA1
a7c6ef74d64e4648a5c7db7a1459a76333422079
-
SHA256
b58adddce5e14846f38f0962e01200b959d5e88149d696708bf17b5df3498667
-
SHA512
ef446241c2b61242e8fe371eaafad902c266117b2f1eb078beda38bc5ad6830fb94a2ba6ca51b02d8a5d830a1e1b8f1a8e04ee824b016a5de0fbae8f0878c5a8
-
SSDEEP
12288:/U5rCOTeiDnOzBAAKZnHm0QBLZZiKjAI/NZ:/UQOJDOzBlMG02VZRAI/N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1708 5091.tmp 1224 510E.tmp 4516 518B.tmp 1580 51E9.tmp 1920 5237.tmp 2768 5294.tmp 3148 5302.tmp 5008 536F.tmp 4564 53DD.tmp 2816 544A.tmp 1016 5498.tmp 4712 54E6.tmp 3568 5534.tmp 1824 5582.tmp 4100 55E0.tmp 764 562E.tmp 4052 567C.tmp 4544 56DA.tmp 4436 5728.tmp 2592 5776.tmp 4872 57C5.tmp 2148 5832.tmp 1664 5880.tmp 2228 58DE.tmp 1848 592C.tmp 5084 598A.tmp 1208 59D8.tmp 4588 5A36.tmp 4092 5A93.tmp 4144 5B01.tmp 4496 5B4F.tmp 4004 5BAD.tmp 2420 5BFB.tmp 3004 5C49.tmp 1636 5C97.tmp 1072 5D04.tmp 4208 5D52.tmp 916 5DB0.tmp 3844 5DFE.tmp 2664 5E4C.tmp 2732 5E9B.tmp 4404 5EE9.tmp 4160 5F46.tmp 5016 5F95.tmp 4628 5FE3.tmp 740 6031.tmp 2636 607F.tmp 4180 60CD.tmp 1284 611B.tmp 1340 6169.tmp 4824 61B7.tmp 3216 6206.tmp 1800 6263.tmp 4960 62B1.tmp 4704 6300.tmp 3512 634E.tmp 1704 639C.tmp 636 63EA.tmp 1676 6438.tmp 4412 6486.tmp 4980 64D4.tmp 680 6522.tmp 3548 6571.tmp 5080 65BF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 1708 628 2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe 84 PID 628 wrote to memory of 1708 628 2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe 84 PID 628 wrote to memory of 1708 628 2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe 84 PID 1708 wrote to memory of 1224 1708 5091.tmp 85 PID 1708 wrote to memory of 1224 1708 5091.tmp 85 PID 1708 wrote to memory of 1224 1708 5091.tmp 85 PID 1224 wrote to memory of 4516 1224 510E.tmp 86 PID 1224 wrote to memory of 4516 1224 510E.tmp 86 PID 1224 wrote to memory of 4516 1224 510E.tmp 86 PID 4516 wrote to memory of 1580 4516 518B.tmp 87 PID 4516 wrote to memory of 1580 4516 518B.tmp 87 PID 4516 wrote to memory of 1580 4516 518B.tmp 87 PID 1580 wrote to memory of 1920 1580 51E9.tmp 88 PID 1580 wrote to memory of 1920 1580 51E9.tmp 88 PID 1580 wrote to memory of 1920 1580 51E9.tmp 88 PID 1920 wrote to memory of 2768 1920 5237.tmp 89 PID 1920 wrote to memory of 2768 1920 5237.tmp 89 PID 1920 wrote to memory of 2768 1920 5237.tmp 89 PID 2768 wrote to memory of 3148 2768 5294.tmp 90 PID 2768 wrote to memory of 3148 2768 5294.tmp 90 PID 2768 wrote to memory of 3148 2768 5294.tmp 90 PID 3148 wrote to memory of 5008 3148 5302.tmp 91 PID 3148 wrote to memory of 5008 3148 5302.tmp 91 PID 3148 wrote to memory of 5008 3148 5302.tmp 91 PID 5008 wrote to memory of 4564 5008 536F.tmp 92 PID 5008 wrote to memory of 4564 5008 536F.tmp 92 PID 5008 wrote to memory of 4564 5008 536F.tmp 92 PID 4564 wrote to memory of 2816 4564 53DD.tmp 93 PID 4564 wrote to memory of 2816 4564 53DD.tmp 93 PID 4564 wrote to memory of 2816 4564 53DD.tmp 93 PID 2816 wrote to memory of 1016 2816 544A.tmp 94 PID 2816 wrote to memory of 1016 2816 544A.tmp 94 PID 2816 wrote to memory of 1016 2816 544A.tmp 94 PID 1016 wrote to memory of 4712 1016 5498.tmp 95 PID 1016 wrote to memory of 4712 1016 5498.tmp 95 PID 1016 wrote to memory of 4712 1016 5498.tmp 95 PID 4712 wrote to memory of 3568 4712 54E6.tmp 96 PID 4712 wrote to memory of 3568 4712 54E6.tmp 96 PID 4712 wrote to memory of 3568 4712 54E6.tmp 96 PID 3568 wrote to memory of 1824 3568 5534.tmp 97 PID 3568 wrote to memory of 1824 3568 5534.tmp 97 PID 3568 wrote to memory of 1824 3568 5534.tmp 97 PID 1824 wrote to memory of 4100 1824 5582.tmp 98 PID 1824 wrote to memory of 4100 1824 5582.tmp 98 PID 1824 wrote to memory of 4100 1824 5582.tmp 98 PID 4100 wrote to memory of 764 4100 55E0.tmp 99 PID 4100 wrote to memory of 764 4100 55E0.tmp 99 PID 4100 wrote to memory of 764 4100 55E0.tmp 99 PID 764 wrote to memory of 4052 764 562E.tmp 100 PID 764 wrote to memory of 4052 764 562E.tmp 100 PID 764 wrote to memory of 4052 764 562E.tmp 100 PID 4052 wrote to memory of 4544 4052 567C.tmp 101 PID 4052 wrote to memory of 4544 4052 567C.tmp 101 PID 4052 wrote to memory of 4544 4052 567C.tmp 101 PID 4544 wrote to memory of 4436 4544 56DA.tmp 102 PID 4544 wrote to memory of 4436 4544 56DA.tmp 102 PID 4544 wrote to memory of 4436 4544 56DA.tmp 102 PID 4436 wrote to memory of 2592 4436 5728.tmp 103 PID 4436 wrote to memory of 2592 4436 5728.tmp 103 PID 4436 wrote to memory of 2592 4436 5728.tmp 103 PID 2592 wrote to memory of 4872 2592 5776.tmp 104 PID 2592 wrote to memory of 4872 2592 5776.tmp 104 PID 2592 wrote to memory of 4872 2592 5776.tmp 104 PID 4872 wrote to memory of 2148 4872 57C5.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_0f77a1e997a728cab896c3ef42e0f882_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"23⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"24⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"25⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"26⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"27⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"28⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"29⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"30⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"31⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"32⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"33⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"34⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"35⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"36⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"37⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"38⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"39⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"40⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"41⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"42⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"43⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"44⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"45⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"46⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"47⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"48⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"49⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"50⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"51⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"52⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"53⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"54⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"55⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"56⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"57⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"58⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"59⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"60⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"61⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"62⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"63⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"64⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"65⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"66⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"67⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"68⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"69⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"70⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"71⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"72⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"73⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"74⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"75⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"77⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"78⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"79⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"80⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"81⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"82⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"83⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"84⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"85⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"86⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"87⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"88⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"89⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"90⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"91⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"92⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"93⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"94⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"95⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"96⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"98⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"99⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"100⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"101⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"102⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"103⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"104⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"105⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"106⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"107⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"108⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"109⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"110⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"111⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"113⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"114⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"115⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"116⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"117⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"118⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"119⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"120⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"121⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"122⤵PID:2504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-