Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 18:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe
-
Size
488KB
-
MD5
bf9baac03928c7f2a68be812b088248f
-
SHA1
fdf76626f72a6fe40e5ae7666064f70ca2281d35
-
SHA256
3f851aca257b0f65eb5796b3302373aace13dc85f30d45f4522c8bd93f54b24a
-
SHA512
ee1a69ad49481744eff71834f29414ad25b45f9093e928b8cdbc70c01b27ea42c8f9b050e0d2ae3779e92a45e001ed0c70a681e080d03717c75be0fab98aff10
-
SSDEEP
12288:/U5rCOTeiDaIesA2mUzb6gxGwLCaBiNZ:/UQOJDfGgxGwIN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3844 45E2.tmp 3552 4640.tmp 3736 46BD.tmp 2480 473A.tmp 4084 4788.tmp 2652 47D6.tmp 3304 4834.tmp 4356 48A2.tmp 4896 490F.tmp 636 496D.tmp 4316 49CA.tmp 4600 4A19.tmp 2180 4A76.tmp 1132 4AC4.tmp 552 4B22.tmp 1128 4B70.tmp 2060 4BBE.tmp 3464 4C3B.tmp 4456 4C8A.tmp 1400 4CD8.tmp 2540 4D55.tmp 3376 4DB2.tmp 864 4E10.tmp 3136 4E6E.tmp 3128 4EDB.tmp 5044 4F49.tmp 1816 4FB6.tmp 3904 5023.tmp 4472 5091.tmp 2244 50DF.tmp 2488 512D.tmp 3972 517B.tmp 3564 51D9.tmp 4160 5246.tmp 4700 52A4.tmp 228 5302.tmp 2676 5350.tmp 2752 539E.tmp 1540 53FC.tmp 3252 5479.tmp 4924 54D7.tmp 980 5525.tmp 3884 5563.tmp 1204 55B1.tmp 4352 55FF.tmp 1160 564E.tmp 5104 569C.tmp 3680 56EA.tmp 4296 5738.tmp 4280 5786.tmp 3956 57D4.tmp 8 5822.tmp 116 5870.tmp 3552 58BF.tmp 3748 592C.tmp 648 597A.tmp 2480 59C8.tmp 2724 5A16.tmp 3212 5A64.tmp 2896 5AB3.tmp 3084 5B01.tmp 3304 5B5E.tmp 3836 5BAD.tmp 4620 5BFB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3184 wrote to memory of 3844 3184 2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe 85 PID 3184 wrote to memory of 3844 3184 2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe 85 PID 3184 wrote to memory of 3844 3184 2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe 85 PID 3844 wrote to memory of 3552 3844 45E2.tmp 86 PID 3844 wrote to memory of 3552 3844 45E2.tmp 86 PID 3844 wrote to memory of 3552 3844 45E2.tmp 86 PID 3552 wrote to memory of 3736 3552 4640.tmp 87 PID 3552 wrote to memory of 3736 3552 4640.tmp 87 PID 3552 wrote to memory of 3736 3552 4640.tmp 87 PID 3736 wrote to memory of 2480 3736 46BD.tmp 88 PID 3736 wrote to memory of 2480 3736 46BD.tmp 88 PID 3736 wrote to memory of 2480 3736 46BD.tmp 88 PID 2480 wrote to memory of 4084 2480 473A.tmp 89 PID 2480 wrote to memory of 4084 2480 473A.tmp 89 PID 2480 wrote to memory of 4084 2480 473A.tmp 89 PID 4084 wrote to memory of 2652 4084 4788.tmp 90 PID 4084 wrote to memory of 2652 4084 4788.tmp 90 PID 4084 wrote to memory of 2652 4084 4788.tmp 90 PID 2652 wrote to memory of 3304 2652 47D6.tmp 91 PID 2652 wrote to memory of 3304 2652 47D6.tmp 91 PID 2652 wrote to memory of 3304 2652 47D6.tmp 91 PID 3304 wrote to memory of 4356 3304 4834.tmp 92 PID 3304 wrote to memory of 4356 3304 4834.tmp 92 PID 3304 wrote to memory of 4356 3304 4834.tmp 92 PID 4356 wrote to memory of 4896 4356 48A2.tmp 93 PID 4356 wrote to memory of 4896 4356 48A2.tmp 93 PID 4356 wrote to memory of 4896 4356 48A2.tmp 93 PID 4896 wrote to memory of 636 4896 490F.tmp 94 PID 4896 wrote to memory of 636 4896 490F.tmp 94 PID 4896 wrote to memory of 636 4896 490F.tmp 94 PID 636 wrote to memory of 4316 636 496D.tmp 95 PID 636 wrote to memory of 4316 636 496D.tmp 95 PID 636 wrote to memory of 4316 636 496D.tmp 95 PID 4316 wrote to memory of 4600 4316 49CA.tmp 96 PID 4316 wrote to memory of 4600 4316 49CA.tmp 96 PID 4316 wrote to memory of 4600 4316 49CA.tmp 96 PID 4600 wrote to memory of 2180 4600 4A19.tmp 97 PID 4600 wrote to memory of 2180 4600 4A19.tmp 97 PID 4600 wrote to memory of 2180 4600 4A19.tmp 97 PID 2180 wrote to memory of 1132 2180 4A76.tmp 98 PID 2180 wrote to memory of 1132 2180 4A76.tmp 98 PID 2180 wrote to memory of 1132 2180 4A76.tmp 98 PID 1132 wrote to memory of 552 1132 4AC4.tmp 99 PID 1132 wrote to memory of 552 1132 4AC4.tmp 99 PID 1132 wrote to memory of 552 1132 4AC4.tmp 99 PID 552 wrote to memory of 1128 552 4B22.tmp 100 PID 552 wrote to memory of 1128 552 4B22.tmp 100 PID 552 wrote to memory of 1128 552 4B22.tmp 100 PID 1128 wrote to memory of 2060 1128 4B70.tmp 101 PID 1128 wrote to memory of 2060 1128 4B70.tmp 101 PID 1128 wrote to memory of 2060 1128 4B70.tmp 101 PID 2060 wrote to memory of 3464 2060 4BBE.tmp 102 PID 2060 wrote to memory of 3464 2060 4BBE.tmp 102 PID 2060 wrote to memory of 3464 2060 4BBE.tmp 102 PID 3464 wrote to memory of 4456 3464 4C3B.tmp 103 PID 3464 wrote to memory of 4456 3464 4C3B.tmp 103 PID 3464 wrote to memory of 4456 3464 4C3B.tmp 103 PID 4456 wrote to memory of 1400 4456 4C8A.tmp 104 PID 4456 wrote to memory of 1400 4456 4C8A.tmp 104 PID 4456 wrote to memory of 1400 4456 4C8A.tmp 104 PID 1400 wrote to memory of 2540 1400 4CD8.tmp 105 PID 1400 wrote to memory of 2540 1400 4CD8.tmp 105 PID 1400 wrote to memory of 2540 1400 4CD8.tmp 105 PID 2540 wrote to memory of 3376 2540 4D55.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_bf9baac03928c7f2a68be812b088248f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"23⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"24⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"25⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"26⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"27⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"28⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"29⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"30⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"31⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"32⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"33⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"34⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"35⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"36⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"37⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"38⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"39⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"40⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"41⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"42⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"43⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"44⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"45⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"46⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"47⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"48⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"49⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"50⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"51⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"52⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"53⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"54⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"55⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"56⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"57⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"58⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"59⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"60⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"61⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"62⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"63⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"64⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"65⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"66⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"67⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"68⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"69⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"70⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"71⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"72⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"73⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"74⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"75⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"76⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"77⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"78⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"79⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"80⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"81⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"82⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"83⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"84⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"85⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"86⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"87⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"88⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"89⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"90⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"91⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"93⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"94⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"95⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"96⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"97⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"98⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"99⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"100⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"101⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"102⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"103⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"104⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"105⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"106⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"107⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"108⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"109⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"110⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"111⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"112⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"113⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"114⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"115⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"116⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"117⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"118⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"119⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"120⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"121⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"122⤵PID:1920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-