Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe
-
Size
520KB
-
MD5
fe22643a1d14f5062265de124e4a829f
-
SHA1
de0bf4340cb3a4670df4abfdc19ec98cc02ab294
-
SHA256
efd60b435d32b83e58eba0754f1f7fabef57f1fcdff825ac6660cb5df87f5374
-
SHA512
722d6d37d8c799d013e9c555ab82f154add8942efbc78565a04fb01dc1e5b6618a7b360ad3941b8a11251002353c1ec96fccfe3c20469101c18ac69e13cff2ea
-
SSDEEP
12288:gj8fuxR21t5i8fRkEQWoBQ/ZMEF+jBhLNZ:gj8fuK1GY2JWoB+rF+XN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4204 44BA.tmp 4648 4517.tmp 2124 4575.tmp 5056 45E2.tmp 5024 4640.tmp 4128 46BD.tmp 4840 471B.tmp 1948 4798.tmp 2332 4815.tmp 5060 4873.tmp 3060 48E0.tmp 2744 493E.tmp 2116 49BB.tmp 716 4A09.tmp 3340 4A86.tmp 4552 4AF3.tmp 3484 4B61.tmp 4260 4BAF.tmp 3680 4C3B.tmp 4932 4CA9.tmp 4688 4CF7.tmp 4576 4D74.tmp 1688 4DD2.tmp 3500 4E20.tmp 1560 4E8D.tmp 1532 4EFB.tmp 4772 4F68.tmp 4228 4FC6.tmp 1392 5014.tmp 4776 5062.tmp 3452 50DF.tmp 1344 513D.tmp 4524 51BA.tmp 1160 5208.tmp 2044 5256.tmp 4472 52B4.tmp 2436 5302.tmp 412 5360.tmp 4792 53AE.tmp 3724 540B.tmp 756 545A.tmp 3168 54A8.tmp 1828 54F6.tmp 2432 5544.tmp 2424 55A2.tmp 4476 55FF.tmp 2484 565D.tmp 4920 56AB.tmp 2860 5709.tmp 3960 5757.tmp 3844 57A5.tmp 3852 5803.tmp 4416 5861.tmp 3080 58AF.tmp 4320 58FD.tmp 1000 595B.tmp 4924 59A9.tmp 4528 59F7.tmp 4648 5A55.tmp 2952 5AB3.tmp 1940 5B10.tmp 2228 5B6E.tmp 2764 5BBC.tmp 4008 5C0A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3572 wrote to memory of 4204 3572 2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe 83 PID 3572 wrote to memory of 4204 3572 2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe 83 PID 3572 wrote to memory of 4204 3572 2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe 83 PID 4204 wrote to memory of 4648 4204 44BA.tmp 84 PID 4204 wrote to memory of 4648 4204 44BA.tmp 84 PID 4204 wrote to memory of 4648 4204 44BA.tmp 84 PID 4648 wrote to memory of 2124 4648 4517.tmp 85 PID 4648 wrote to memory of 2124 4648 4517.tmp 85 PID 4648 wrote to memory of 2124 4648 4517.tmp 85 PID 2124 wrote to memory of 5056 2124 4575.tmp 87 PID 2124 wrote to memory of 5056 2124 4575.tmp 87 PID 2124 wrote to memory of 5056 2124 4575.tmp 87 PID 5056 wrote to memory of 5024 5056 45E2.tmp 89 PID 5056 wrote to memory of 5024 5056 45E2.tmp 89 PID 5056 wrote to memory of 5024 5056 45E2.tmp 89 PID 5024 wrote to memory of 4128 5024 4640.tmp 91 PID 5024 wrote to memory of 4128 5024 4640.tmp 91 PID 5024 wrote to memory of 4128 5024 4640.tmp 91 PID 4128 wrote to memory of 4840 4128 46BD.tmp 92 PID 4128 wrote to memory of 4840 4128 46BD.tmp 92 PID 4128 wrote to memory of 4840 4128 46BD.tmp 92 PID 4840 wrote to memory of 1948 4840 471B.tmp 93 PID 4840 wrote to memory of 1948 4840 471B.tmp 93 PID 4840 wrote to memory of 1948 4840 471B.tmp 93 PID 1948 wrote to memory of 2332 1948 4798.tmp 94 PID 1948 wrote to memory of 2332 1948 4798.tmp 94 PID 1948 wrote to memory of 2332 1948 4798.tmp 94 PID 2332 wrote to memory of 5060 2332 4815.tmp 95 PID 2332 wrote to memory of 5060 2332 4815.tmp 95 PID 2332 wrote to memory of 5060 2332 4815.tmp 95 PID 5060 wrote to memory of 3060 5060 4873.tmp 96 PID 5060 wrote to memory of 3060 5060 4873.tmp 96 PID 5060 wrote to memory of 3060 5060 4873.tmp 96 PID 3060 wrote to memory of 2744 3060 48E0.tmp 97 PID 3060 wrote to memory of 2744 3060 48E0.tmp 97 PID 3060 wrote to memory of 2744 3060 48E0.tmp 97 PID 2744 wrote to memory of 2116 2744 493E.tmp 98 PID 2744 wrote to memory of 2116 2744 493E.tmp 98 PID 2744 wrote to memory of 2116 2744 493E.tmp 98 PID 2116 wrote to memory of 716 2116 49BB.tmp 99 PID 2116 wrote to memory of 716 2116 49BB.tmp 99 PID 2116 wrote to memory of 716 2116 49BB.tmp 99 PID 716 wrote to memory of 3340 716 4A09.tmp 100 PID 716 wrote to memory of 3340 716 4A09.tmp 100 PID 716 wrote to memory of 3340 716 4A09.tmp 100 PID 3340 wrote to memory of 4552 3340 4A86.tmp 101 PID 3340 wrote to memory of 4552 3340 4A86.tmp 101 PID 3340 wrote to memory of 4552 3340 4A86.tmp 101 PID 4552 wrote to memory of 3484 4552 4AF3.tmp 102 PID 4552 wrote to memory of 3484 4552 4AF3.tmp 102 PID 4552 wrote to memory of 3484 4552 4AF3.tmp 102 PID 3484 wrote to memory of 4260 3484 4B61.tmp 103 PID 3484 wrote to memory of 4260 3484 4B61.tmp 103 PID 3484 wrote to memory of 4260 3484 4B61.tmp 103 PID 4260 wrote to memory of 3680 4260 4BAF.tmp 104 PID 4260 wrote to memory of 3680 4260 4BAF.tmp 104 PID 4260 wrote to memory of 3680 4260 4BAF.tmp 104 PID 3680 wrote to memory of 4932 3680 4C3B.tmp 105 PID 3680 wrote to memory of 4932 3680 4C3B.tmp 105 PID 3680 wrote to memory of 4932 3680 4C3B.tmp 105 PID 4932 wrote to memory of 4688 4932 4CA9.tmp 106 PID 4932 wrote to memory of 4688 4932 4CA9.tmp 106 PID 4932 wrote to memory of 4688 4932 4CA9.tmp 106 PID 4688 wrote to memory of 4576 4688 4CF7.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe22643a1d14f5062265de124e4a829f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"23⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"24⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"25⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"26⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"27⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"28⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"29⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"30⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"31⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"32⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"33⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"34⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"35⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"36⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"37⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"38⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"39⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"40⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"41⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"42⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"43⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"44⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"45⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"46⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"47⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"48⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"49⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"50⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"51⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"52⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"53⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"54⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"55⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"56⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"57⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"58⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"59⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"60⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"61⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"62⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"63⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"64⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"65⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"66⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"67⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"68⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"69⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"70⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"71⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"72⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"73⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"74⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"75⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"76⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"77⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"78⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"79⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"80⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"81⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"82⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"83⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"84⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"85⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"86⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"87⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"88⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"89⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"90⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"91⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"92⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"93⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"94⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"95⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"96⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"97⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"98⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"99⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"100⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"101⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"102⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"103⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"104⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"105⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"106⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"107⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"108⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"109⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"110⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"111⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"112⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"113⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"114⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"115⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"116⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"117⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"118⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"119⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"120⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"121⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"122⤵PID:804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-