Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 07:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
-
Size
520KB
-
MD5
afc815477106f6d600d1a00af5af7917
-
SHA1
956a866473a9cdc05f60c66743b252bb244e6951
-
SHA256
387318e024eb8a13d8cc2eee16d7dc104a5d9dabf4713c24b1063d146021c94b
-
SHA512
492ec703c3779f2ef0f2590863aea9ac954ee426edb8d53ab3a4e9e5d2b69f9634a54f7a9a71426ba9cedd77cf14b819593f73fa6452024d1092211c0d55b04f
-
SSDEEP
12288:roRXOQjmOymaXoOR7s9Rk7Y6AmifkS/uTuMG3SunNZ:rogQ9yjXps9R+J3UrYuMQN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3576 4CE7.tmp 888 4D64.tmp 376 4DF1.tmp 2444 4E5E.tmp 2640 4EEB.tmp 2056 4F39.tmp 3808 4FB6.tmp 3984 5014.tmp 368 5072.tmp 116 50C0.tmp 4992 510E.tmp 2948 516C.tmp 2456 51E9.tmp 5100 5237.tmp 4680 52A4.tmp 3588 52F2.tmp 4808 536F.tmp 3980 53BD.tmp 3180 541B.tmp 3376 5488.tmp 1564 54F6.tmp 320 5563.tmp 456 55C1.tmp 1080 562E.tmp 2900 56AB.tmp 1556 5709.tmp 1704 5767.tmp 3988 57C5.tmp 2776 5842.tmp 4508 58AF.tmp 4024 591C.tmp 4484 598A.tmp 2856 59E7.tmp 4776 5A45.tmp 4204 5A93.tmp 3692 5AF1.tmp 4608 5B3F.tmp 2452 5B9D.tmp 4704 5BEB.tmp 2792 5C39.tmp 3472 5C87.tmp 3496 5CE5.tmp 1276 5D33.tmp 1256 5D91.tmp 1112 5DEF.tmp 4620 5E3D.tmp 3412 5E8B.tmp 5000 5ED9.tmp 440 5F37.tmp 3332 5F85.tmp 1604 5FD3.tmp 1936 6040.tmp 2468 608F.tmp 4460 60DD.tmp 2944 612B.tmp 4856 61C7.tmp 4468 6225.tmp 1980 6273.tmp 2224 62C1.tmp 2928 630F.tmp 468 635D.tmp 2916 63AB.tmp 3532 6409.tmp 2816 6467.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3992 wrote to memory of 3576 3992 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 85 PID 3992 wrote to memory of 3576 3992 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 85 PID 3992 wrote to memory of 3576 3992 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 85 PID 3576 wrote to memory of 888 3576 4CE7.tmp 86 PID 3576 wrote to memory of 888 3576 4CE7.tmp 86 PID 3576 wrote to memory of 888 3576 4CE7.tmp 86 PID 888 wrote to memory of 376 888 4D64.tmp 87 PID 888 wrote to memory of 376 888 4D64.tmp 87 PID 888 wrote to memory of 376 888 4D64.tmp 87 PID 376 wrote to memory of 2444 376 4DF1.tmp 88 PID 376 wrote to memory of 2444 376 4DF1.tmp 88 PID 376 wrote to memory of 2444 376 4DF1.tmp 88 PID 2444 wrote to memory of 2640 2444 4E5E.tmp 89 PID 2444 wrote to memory of 2640 2444 4E5E.tmp 89 PID 2444 wrote to memory of 2640 2444 4E5E.tmp 89 PID 2640 wrote to memory of 2056 2640 4EEB.tmp 90 PID 2640 wrote to memory of 2056 2640 4EEB.tmp 90 PID 2640 wrote to memory of 2056 2640 4EEB.tmp 90 PID 2056 wrote to memory of 3808 2056 4F39.tmp 91 PID 2056 wrote to memory of 3808 2056 4F39.tmp 91 PID 2056 wrote to memory of 3808 2056 4F39.tmp 91 PID 3808 wrote to memory of 3984 3808 4FB6.tmp 92 PID 3808 wrote to memory of 3984 3808 4FB6.tmp 92 PID 3808 wrote to memory of 3984 3808 4FB6.tmp 92 PID 3984 wrote to memory of 368 3984 5014.tmp 93 PID 3984 wrote to memory of 368 3984 5014.tmp 93 PID 3984 wrote to memory of 368 3984 5014.tmp 93 PID 368 wrote to memory of 116 368 5072.tmp 94 PID 368 wrote to memory of 116 368 5072.tmp 94 PID 368 wrote to memory of 116 368 5072.tmp 94 PID 116 wrote to memory of 4992 116 50C0.tmp 95 PID 116 wrote to memory of 4992 116 50C0.tmp 95 PID 116 wrote to memory of 4992 116 50C0.tmp 95 PID 4992 wrote to memory of 2948 4992 510E.tmp 96 PID 4992 wrote to memory of 2948 4992 510E.tmp 96 PID 4992 wrote to memory of 2948 4992 510E.tmp 96 PID 2948 wrote to memory of 2456 2948 516C.tmp 97 PID 2948 wrote to memory of 2456 2948 516C.tmp 97 PID 2948 wrote to memory of 2456 2948 516C.tmp 97 PID 2456 wrote to memory of 5100 2456 51E9.tmp 98 PID 2456 wrote to memory of 5100 2456 51E9.tmp 98 PID 2456 wrote to memory of 5100 2456 51E9.tmp 98 PID 5100 wrote to memory of 4680 5100 5237.tmp 99 PID 5100 wrote to memory of 4680 5100 5237.tmp 99 PID 5100 wrote to memory of 4680 5100 5237.tmp 99 PID 4680 wrote to memory of 3588 4680 52A4.tmp 100 PID 4680 wrote to memory of 3588 4680 52A4.tmp 100 PID 4680 wrote to memory of 3588 4680 52A4.tmp 100 PID 3588 wrote to memory of 4808 3588 52F2.tmp 101 PID 3588 wrote to memory of 4808 3588 52F2.tmp 101 PID 3588 wrote to memory of 4808 3588 52F2.tmp 101 PID 4808 wrote to memory of 3980 4808 536F.tmp 102 PID 4808 wrote to memory of 3980 4808 536F.tmp 102 PID 4808 wrote to memory of 3980 4808 536F.tmp 102 PID 3980 wrote to memory of 3180 3980 53BD.tmp 103 PID 3980 wrote to memory of 3180 3980 53BD.tmp 103 PID 3980 wrote to memory of 3180 3980 53BD.tmp 103 PID 3180 wrote to memory of 3376 3180 541B.tmp 104 PID 3180 wrote to memory of 3376 3180 541B.tmp 104 PID 3180 wrote to memory of 3376 3180 541B.tmp 104 PID 3376 wrote to memory of 1564 3376 5488.tmp 105 PID 3376 wrote to memory of 1564 3376 5488.tmp 105 PID 3376 wrote to memory of 1564 3376 5488.tmp 105 PID 1564 wrote to memory of 320 1564 54F6.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"23⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"24⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"25⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"26⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"27⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"28⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"29⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"30⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"31⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"32⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"33⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"34⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"35⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"36⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"37⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"38⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"39⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"40⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"41⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"42⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"43⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"44⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"45⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"46⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"47⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"48⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"49⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"50⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"51⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"52⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"53⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"54⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"55⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"56⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"57⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"58⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"59⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"60⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"61⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"62⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"63⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"64⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"65⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"66⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"67⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"68⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"70⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"71⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"72⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"73⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"74⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"75⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"76⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"77⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"78⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"79⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"80⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"81⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"82⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"83⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"84⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"85⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"86⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"87⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"88⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"89⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"91⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"92⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"93⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"94⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"95⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"96⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"97⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"98⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"99⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"100⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"101⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"102⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"103⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"104⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"105⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"106⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"107⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"108⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"109⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"110⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"111⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"112⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"113⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"114⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"115⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"116⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"117⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"118⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"119⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"120⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"121⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"122⤵PID:4792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-