Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
-
Size
712KB
-
MD5
46d8a178f6c015690e6c7a7ff83b59b3
-
SHA1
07af3656a1e624d5bbe669fe2fa13fc13f4d0dc6
-
SHA256
d9e024dafca91a29f469c5df10175f23873f9d40db907bc68563bd15d23cf5a6
-
SHA512
0f5c7000a275a17bffd1fd77947170868e400bd8d8ab57f1153a5e5d7c0f3c59c8c09762df3680ded643a13d33e6a894e1d4a6ebfeaecf84a8f5d105c2183730
-
SSDEEP
12288:FU5rCOTeiDhKNSmTxn2oSDnyPEJRNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDu2tLRJRNnCvq5TJLCvY90D8/L5
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3412 4391.tmp 2536 442D.tmp 2940 44E8.tmp 1612 4594.tmp 1992 4611.tmp 4640 468E.tmp 2756 470B.tmp 696 4798.tmp 2004 4834.tmp 4204 48D0.tmp 1444 494D.tmp 4540 49EA.tmp 3852 4A86.tmp 4196 4B70.tmp 3136 4C2C.tmp 2700 4CA9.tmp 4508 4D16.tmp 1276 4D84.tmp 3232 4DE1.tmp 1208 4E3F.tmp 4044 4EAC.tmp 4440 4F39.tmp 1256 4FE5.tmp 4324 5081.tmp 3956 515C.tmp 4312 51BA.tmp 4984 5266.tmp 2480 52D3.tmp 1596 5350.tmp 4100 53EC.tmp 4384 544A.tmp 4480 54B7.tmp 2236 5554.tmp 2720 55B1.tmp 2160 560F.tmp 944 566D.tmp 3184 56CB.tmp 2512 5719.tmp 3748 5776.tmp 3560 57D4.tmp 4820 5832.tmp 3024 589F.tmp 3876 58FD.tmp 1968 596A.tmp 3784 59C8.tmp 1892 5A26.tmp 4228 5A93.tmp 4640 5AF1.tmp 4412 5B4F.tmp 3980 5BBC.tmp 2376 5C1A.tmp 3016 5C87.tmp 4040 5CF5.tmp 4828 5D62.tmp 1576 5DC0.tmp 1920 5E2D.tmp 2516 5E8B.tmp 2620 5EF8.tmp 1644 5F66.tmp 3148 5FC3.tmp 2628 6021.tmp 2000 606F.tmp 1696 60CD.tmp 4344 611B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 3412 976 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 89 PID 976 wrote to memory of 3412 976 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 89 PID 976 wrote to memory of 3412 976 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 89 PID 3412 wrote to memory of 2536 3412 4391.tmp 90 PID 3412 wrote to memory of 2536 3412 4391.tmp 90 PID 3412 wrote to memory of 2536 3412 4391.tmp 90 PID 2536 wrote to memory of 2940 2536 442D.tmp 91 PID 2536 wrote to memory of 2940 2536 442D.tmp 91 PID 2536 wrote to memory of 2940 2536 442D.tmp 91 PID 2940 wrote to memory of 1612 2940 44E8.tmp 93 PID 2940 wrote to memory of 1612 2940 44E8.tmp 93 PID 2940 wrote to memory of 1612 2940 44E8.tmp 93 PID 1612 wrote to memory of 1992 1612 4594.tmp 95 PID 1612 wrote to memory of 1992 1612 4594.tmp 95 PID 1612 wrote to memory of 1992 1612 4594.tmp 95 PID 1992 wrote to memory of 4640 1992 4611.tmp 96 PID 1992 wrote to memory of 4640 1992 4611.tmp 96 PID 1992 wrote to memory of 4640 1992 4611.tmp 96 PID 4640 wrote to memory of 2756 4640 468E.tmp 98 PID 4640 wrote to memory of 2756 4640 468E.tmp 98 PID 4640 wrote to memory of 2756 4640 468E.tmp 98 PID 2756 wrote to memory of 696 2756 470B.tmp 99 PID 2756 wrote to memory of 696 2756 470B.tmp 99 PID 2756 wrote to memory of 696 2756 470B.tmp 99 PID 696 wrote to memory of 2004 696 4798.tmp 100 PID 696 wrote to memory of 2004 696 4798.tmp 100 PID 696 wrote to memory of 2004 696 4798.tmp 100 PID 2004 wrote to memory of 4204 2004 4834.tmp 101 PID 2004 wrote to memory of 4204 2004 4834.tmp 101 PID 2004 wrote to memory of 4204 2004 4834.tmp 101 PID 4204 wrote to memory of 1444 4204 48D0.tmp 102 PID 4204 wrote to memory of 1444 4204 48D0.tmp 102 PID 4204 wrote to memory of 1444 4204 48D0.tmp 102 PID 1444 wrote to memory of 4540 1444 494D.tmp 103 PID 1444 wrote to memory of 4540 1444 494D.tmp 103 PID 1444 wrote to memory of 4540 1444 494D.tmp 103 PID 4540 wrote to memory of 3852 4540 49EA.tmp 104 PID 4540 wrote to memory of 3852 4540 49EA.tmp 104 PID 4540 wrote to memory of 3852 4540 49EA.tmp 104 PID 3852 wrote to memory of 4196 3852 4A86.tmp 105 PID 3852 wrote to memory of 4196 3852 4A86.tmp 105 PID 3852 wrote to memory of 4196 3852 4A86.tmp 105 PID 4196 wrote to memory of 3136 4196 4B70.tmp 106 PID 4196 wrote to memory of 3136 4196 4B70.tmp 106 PID 4196 wrote to memory of 3136 4196 4B70.tmp 106 PID 3136 wrote to memory of 2700 3136 4C2C.tmp 107 PID 3136 wrote to memory of 2700 3136 4C2C.tmp 107 PID 3136 wrote to memory of 2700 3136 4C2C.tmp 107 PID 2700 wrote to memory of 4508 2700 4CA9.tmp 108 PID 2700 wrote to memory of 4508 2700 4CA9.tmp 108 PID 2700 wrote to memory of 4508 2700 4CA9.tmp 108 PID 4508 wrote to memory of 1276 4508 4D16.tmp 109 PID 4508 wrote to memory of 1276 4508 4D16.tmp 109 PID 4508 wrote to memory of 1276 4508 4D16.tmp 109 PID 1276 wrote to memory of 3232 1276 4D84.tmp 110 PID 1276 wrote to memory of 3232 1276 4D84.tmp 110 PID 1276 wrote to memory of 3232 1276 4D84.tmp 110 PID 3232 wrote to memory of 1208 3232 4DE1.tmp 111 PID 3232 wrote to memory of 1208 3232 4DE1.tmp 111 PID 3232 wrote to memory of 1208 3232 4DE1.tmp 111 PID 1208 wrote to memory of 4044 1208 4E3F.tmp 112 PID 1208 wrote to memory of 4044 1208 4E3F.tmp 112 PID 1208 wrote to memory of 4044 1208 4E3F.tmp 112 PID 4044 wrote to memory of 4440 4044 4EAC.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"23⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"24⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"25⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"26⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"27⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"28⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"29⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"30⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"31⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"32⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"33⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"34⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"35⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"36⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"37⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"38⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"39⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"40⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"41⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"42⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"43⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"44⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"45⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"46⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"47⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"48⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"49⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"50⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"51⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"52⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"53⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"54⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"55⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"56⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"57⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"58⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"59⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"60⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"61⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"62⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"63⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"64⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"65⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"66⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"67⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"68⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"69⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"70⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"72⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"73⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"74⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"75⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"76⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"78⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"79⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"80⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"81⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"83⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"84⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"85⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"86⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"87⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"88⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"89⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"90⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"91⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"92⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"93⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"94⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"95⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"96⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"97⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"98⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"99⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"100⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"101⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"102⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"103⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"104⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"105⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"106⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"107⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"108⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"109⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"110⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"111⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"112⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"113⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"114⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"116⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"118⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"119⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"120⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"121⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-