Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe
-
Size
488KB
-
MD5
367685c27a88b6285207a0c1427164c1
-
SHA1
1efca71574c18ae844e2f177e2207b26183d5d1f
-
SHA256
68a891fe155c5c17eacdcced5bb85aa9537e932d4fccf6c14447386393881d61
-
SHA512
9748c8f0ce6ad042447829efc15b2651ed09f1758e7709e2f4e7236d193b0827c5d1fd5dcc96571cf5565d98f3b36306a66d90bb538a61ff247d303f4f404e67
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7AxLjj+mLzjSsI78Lkj9dGHjmcY+vgTKy2cob:/U5rCOTeiDA5OUI78YJdGHycB62c6NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2904 46AE.tmp 1680 473A.tmp 1396 47C7.tmp 3876 4882.tmp 3952 48F0.tmp 640 495D.tmp 3856 49EA.tmp 1596 4A86.tmp 4780 4AF3.tmp 1212 4B61.tmp 464 4BBE.tmp 1816 4C2C.tmp 948 4C99.tmp 2464 4D16.tmp 2740 4D74.tmp 3080 4E10.tmp 344 4E9D.tmp 1812 4F1A.tmp 3868 4FA6.tmp 1668 5043.tmp 1280 50CF.tmp 3384 515C.tmp 1644 51C9.tmp 216 5237.tmp 400 52C3.tmp 2616 5340.tmp 3552 53AE.tmp 4084 541B.tmp 3732 54A8.tmp 1772 5505.tmp 4816 5592.tmp 2660 560F.tmp 364 56AB.tmp 4916 56F9.tmp 1272 5748.tmp 2172 57A5.tmp 4752 5803.tmp 3340 5861.tmp 2340 58CE.tmp 4376 592C.tmp 1000 597A.tmp 4348 59D8.tmp 3112 5A36.tmp 1884 5A93.tmp 4024 5AF1.tmp 436 5B4F.tmp 1188 5BAD.tmp 1344 5C0A.tmp 3012 5C68.tmp 448 5CB6.tmp 1788 5D04.tmp 728 5D62.tmp 3668 5DB0.tmp 3592 5E0E.tmp 3580 5E6C.tmp 4148 5EBA.tmp 2204 5F18.tmp 4176 5F66.tmp 4324 5FC3.tmp 396 6012.tmp 1724 6060.tmp 2904 60AE.tmp 1684 60FC.tmp 4864 614A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3144 wrote to memory of 2904 3144 2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe 84 PID 3144 wrote to memory of 2904 3144 2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe 84 PID 3144 wrote to memory of 2904 3144 2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe 84 PID 2904 wrote to memory of 1680 2904 46AE.tmp 85 PID 2904 wrote to memory of 1680 2904 46AE.tmp 85 PID 2904 wrote to memory of 1680 2904 46AE.tmp 85 PID 1680 wrote to memory of 1396 1680 473A.tmp 86 PID 1680 wrote to memory of 1396 1680 473A.tmp 86 PID 1680 wrote to memory of 1396 1680 473A.tmp 86 PID 1396 wrote to memory of 3876 1396 47C7.tmp 87 PID 1396 wrote to memory of 3876 1396 47C7.tmp 87 PID 1396 wrote to memory of 3876 1396 47C7.tmp 87 PID 3876 wrote to memory of 3952 3876 4882.tmp 88 PID 3876 wrote to memory of 3952 3876 4882.tmp 88 PID 3876 wrote to memory of 3952 3876 4882.tmp 88 PID 3952 wrote to memory of 640 3952 48F0.tmp 89 PID 3952 wrote to memory of 640 3952 48F0.tmp 89 PID 3952 wrote to memory of 640 3952 48F0.tmp 89 PID 640 wrote to memory of 3856 640 495D.tmp 90 PID 640 wrote to memory of 3856 640 495D.tmp 90 PID 640 wrote to memory of 3856 640 495D.tmp 90 PID 3856 wrote to memory of 1596 3856 49EA.tmp 91 PID 3856 wrote to memory of 1596 3856 49EA.tmp 91 PID 3856 wrote to memory of 1596 3856 49EA.tmp 91 PID 1596 wrote to memory of 4780 1596 4A86.tmp 92 PID 1596 wrote to memory of 4780 1596 4A86.tmp 92 PID 1596 wrote to memory of 4780 1596 4A86.tmp 92 PID 4780 wrote to memory of 1212 4780 4AF3.tmp 93 PID 4780 wrote to memory of 1212 4780 4AF3.tmp 93 PID 4780 wrote to memory of 1212 4780 4AF3.tmp 93 PID 1212 wrote to memory of 464 1212 4B61.tmp 94 PID 1212 wrote to memory of 464 1212 4B61.tmp 94 PID 1212 wrote to memory of 464 1212 4B61.tmp 94 PID 464 wrote to memory of 1816 464 4BBE.tmp 95 PID 464 wrote to memory of 1816 464 4BBE.tmp 95 PID 464 wrote to memory of 1816 464 4BBE.tmp 95 PID 1816 wrote to memory of 948 1816 4C2C.tmp 96 PID 1816 wrote to memory of 948 1816 4C2C.tmp 96 PID 1816 wrote to memory of 948 1816 4C2C.tmp 96 PID 948 wrote to memory of 2464 948 4C99.tmp 97 PID 948 wrote to memory of 2464 948 4C99.tmp 97 PID 948 wrote to memory of 2464 948 4C99.tmp 97 PID 2464 wrote to memory of 2740 2464 4D16.tmp 98 PID 2464 wrote to memory of 2740 2464 4D16.tmp 98 PID 2464 wrote to memory of 2740 2464 4D16.tmp 98 PID 2740 wrote to memory of 3080 2740 4D74.tmp 99 PID 2740 wrote to memory of 3080 2740 4D74.tmp 99 PID 2740 wrote to memory of 3080 2740 4D74.tmp 99 PID 3080 wrote to memory of 344 3080 4E10.tmp 100 PID 3080 wrote to memory of 344 3080 4E10.tmp 100 PID 3080 wrote to memory of 344 3080 4E10.tmp 100 PID 344 wrote to memory of 1812 344 4E9D.tmp 101 PID 344 wrote to memory of 1812 344 4E9D.tmp 101 PID 344 wrote to memory of 1812 344 4E9D.tmp 101 PID 1812 wrote to memory of 3868 1812 4F1A.tmp 102 PID 1812 wrote to memory of 3868 1812 4F1A.tmp 102 PID 1812 wrote to memory of 3868 1812 4F1A.tmp 102 PID 3868 wrote to memory of 1668 3868 4FA6.tmp 103 PID 3868 wrote to memory of 1668 3868 4FA6.tmp 103 PID 3868 wrote to memory of 1668 3868 4FA6.tmp 103 PID 1668 wrote to memory of 1280 1668 5043.tmp 104 PID 1668 wrote to memory of 1280 1668 5043.tmp 104 PID 1668 wrote to memory of 1280 1668 5043.tmp 104 PID 1280 wrote to memory of 3384 1280 50CF.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_367685c27a88b6285207a0c1427164c1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"23⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"24⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"25⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"26⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"27⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"28⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"29⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"30⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"31⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"32⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"33⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"34⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"35⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"36⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"37⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"38⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"39⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"40⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"41⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"42⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"43⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"44⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"45⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"46⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"47⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"48⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"49⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"50⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"51⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"52⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"53⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"54⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"55⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"56⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"57⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"58⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"59⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"60⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"61⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"62⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"63⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"64⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"65⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"66⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"67⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"69⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"70⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"71⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"72⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"73⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"74⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"75⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"76⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"77⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"78⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"79⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"81⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"82⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"83⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"84⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"85⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"86⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"87⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"88⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"89⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"90⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"91⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"92⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"93⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"94⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"95⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"96⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"97⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"98⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"100⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"101⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"102⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"103⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"104⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"105⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"106⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"107⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"108⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"109⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"110⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"111⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"112⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"113⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"114⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"115⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"116⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"117⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"118⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"119⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"120⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"121⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"122⤵PID:4444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-