Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 21:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe
-
Size
520KB
-
MD5
6c42d8db735fd25bd26bd8ff86a404d7
-
SHA1
af8bb91f4df849ed063482715a5ec9a915030cf6
-
SHA256
c6bdfb3bb47ea8d2f15941effd7defc65b88f1979b427780361f04127db74d6e
-
SHA512
5630d2df5f9a85bf6860444b3df8f74e02a766bccfa81ed6a12ac383843f062980ca3996dc340bf5b5b719efbc8020bbcd5e6a0c44d21aafdbce31dc4e42354f
-
SSDEEP
12288:roRXOQjmOyxZT2uZrL5sdbSd9RN6gGWwqW0NZ:rogQ9yxZfreZSd9OXQN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1328 C479.tmp 2004 C719.tmp 3456 C8BE.tmp 3548 C9E7.tmp 540 CAA3.tmp 4224 CC87.tmp 2712 CD33.tmp 1256 CE1D.tmp 4460 CED9.tmp 452 CF75.tmp 2924 D011.tmp 4864 D0EC.tmp 3832 D1A8.tmp 3004 D263.tmp 1564 D2FF.tmp 4644 D38C.tmp 4256 D448.tmp 3016 D4F3.tmp 4332 D59F.tmp 3648 D64B.tmp 880 D707.tmp 2124 D793.tmp 4892 D8DB.tmp 2520 D968.tmp 2276 D9F5.tmp 3812 DAB0.tmp 4176 DB5C.tmp 764 DC27.tmp 1764 DCC3.tmp 2464 DD50.tmp 404 DE2B.tmp 4280 DEA8.tmp 5104 DF44.tmp 3520 DFC1.tmp 1048 E0CB.tmp 984 E148.tmp 4580 E1B5.tmp 4472 E222.tmp 4228 E2AF.tmp 4112 E32C.tmp 4324 E3D8.tmp 3272 E455.tmp 3848 E501.tmp 4032 E58D.tmp 3176 E60A.tmp 4872 E7A1.tmp 2812 E81E.tmp 2124 E966.tmp 3872 E9D3.tmp 4832 EA41.tmp 3484 EB79.tmp 2328 EC44.tmp 3568 ECD1.tmp 2700 ED5D.tmp 2572 EDDA.tmp 3208 EE57.tmp 4048 EF32.tmp 2664 EFA0.tmp 3280 F00D.tmp 3944 F09A.tmp 2344 F126.tmp 1888 F194.tmp 3644 F220.tmp 2192 F2AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4552 wrote to memory of 1328 4552 2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe 98 PID 4552 wrote to memory of 1328 4552 2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe 98 PID 4552 wrote to memory of 1328 4552 2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe 98 PID 1328 wrote to memory of 2004 1328 C479.tmp 99 PID 1328 wrote to memory of 2004 1328 C479.tmp 99 PID 1328 wrote to memory of 2004 1328 C479.tmp 99 PID 2004 wrote to memory of 3456 2004 C719.tmp 100 PID 2004 wrote to memory of 3456 2004 C719.tmp 100 PID 2004 wrote to memory of 3456 2004 C719.tmp 100 PID 3456 wrote to memory of 3548 3456 C8BE.tmp 101 PID 3456 wrote to memory of 3548 3456 C8BE.tmp 101 PID 3456 wrote to memory of 3548 3456 C8BE.tmp 101 PID 3548 wrote to memory of 540 3548 C9E7.tmp 102 PID 3548 wrote to memory of 540 3548 C9E7.tmp 102 PID 3548 wrote to memory of 540 3548 C9E7.tmp 102 PID 540 wrote to memory of 4224 540 CAA3.tmp 103 PID 540 wrote to memory of 4224 540 CAA3.tmp 103 PID 540 wrote to memory of 4224 540 CAA3.tmp 103 PID 4224 wrote to memory of 2712 4224 CC87.tmp 104 PID 4224 wrote to memory of 2712 4224 CC87.tmp 104 PID 4224 wrote to memory of 2712 4224 CC87.tmp 104 PID 2712 wrote to memory of 1256 2712 CD33.tmp 105 PID 2712 wrote to memory of 1256 2712 CD33.tmp 105 PID 2712 wrote to memory of 1256 2712 CD33.tmp 105 PID 1256 wrote to memory of 4460 1256 CE1D.tmp 106 PID 1256 wrote to memory of 4460 1256 CE1D.tmp 106 PID 1256 wrote to memory of 4460 1256 CE1D.tmp 106 PID 4460 wrote to memory of 452 4460 CED9.tmp 107 PID 4460 wrote to memory of 452 4460 CED9.tmp 107 PID 4460 wrote to memory of 452 4460 CED9.tmp 107 PID 452 wrote to memory of 2924 452 CF75.tmp 108 PID 452 wrote to memory of 2924 452 CF75.tmp 108 PID 452 wrote to memory of 2924 452 CF75.tmp 108 PID 2924 wrote to memory of 4864 2924 D011.tmp 109 PID 2924 wrote to memory of 4864 2924 D011.tmp 109 PID 2924 wrote to memory of 4864 2924 D011.tmp 109 PID 4864 wrote to memory of 3832 4864 D0EC.tmp 110 PID 4864 wrote to memory of 3832 4864 D0EC.tmp 110 PID 4864 wrote to memory of 3832 4864 D0EC.tmp 110 PID 3832 wrote to memory of 3004 3832 D1A8.tmp 111 PID 3832 wrote to memory of 3004 3832 D1A8.tmp 111 PID 3832 wrote to memory of 3004 3832 D1A8.tmp 111 PID 3004 wrote to memory of 1564 3004 D263.tmp 112 PID 3004 wrote to memory of 1564 3004 D263.tmp 112 PID 3004 wrote to memory of 1564 3004 D263.tmp 112 PID 1564 wrote to memory of 4644 1564 D2FF.tmp 113 PID 1564 wrote to memory of 4644 1564 D2FF.tmp 113 PID 1564 wrote to memory of 4644 1564 D2FF.tmp 113 PID 4644 wrote to memory of 4256 4644 D38C.tmp 114 PID 4644 wrote to memory of 4256 4644 D38C.tmp 114 PID 4644 wrote to memory of 4256 4644 D38C.tmp 114 PID 4256 wrote to memory of 3016 4256 D448.tmp 115 PID 4256 wrote to memory of 3016 4256 D448.tmp 115 PID 4256 wrote to memory of 3016 4256 D448.tmp 115 PID 3016 wrote to memory of 4332 3016 D4F3.tmp 116 PID 3016 wrote to memory of 4332 3016 D4F3.tmp 116 PID 3016 wrote to memory of 4332 3016 D4F3.tmp 116 PID 4332 wrote to memory of 3648 4332 D59F.tmp 117 PID 4332 wrote to memory of 3648 4332 D59F.tmp 117 PID 4332 wrote to memory of 3648 4332 D59F.tmp 117 PID 3648 wrote to memory of 880 3648 D64B.tmp 118 PID 3648 wrote to memory of 880 3648 D64B.tmp 118 PID 3648 wrote to memory of 880 3648 D64B.tmp 118 PID 880 wrote to memory of 2124 880 D707.tmp 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_6c42d8db735fd25bd26bd8ff86a404d7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"23⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"24⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"25⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"26⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"27⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"28⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"29⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"30⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"31⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"32⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"33⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"34⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"35⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"36⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"37⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"38⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"39⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"40⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"41⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"42⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"43⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"44⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"45⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"46⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"48⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"49⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"50⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"51⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"52⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"53⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"54⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"55⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"56⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"57⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"58⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"59⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"60⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"61⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"62⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"63⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"64⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"65⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"66⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"67⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"68⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"69⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"70⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"71⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"72⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"73⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"74⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"75⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"76⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"78⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"79⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"80⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"81⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"82⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"83⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"84⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"85⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"86⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"87⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"88⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"89⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"90⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"91⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"92⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"93⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"94⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"95⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"96⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"97⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"98⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"99⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"100⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"101⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"102⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"103⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"104⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"105⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"106⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"107⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"108⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"109⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"110⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"111⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"112⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"113⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"114⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"115⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"116⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"117⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"118⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"119⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"120⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"121⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"122⤵PID:1536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-