Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe
-
Size
529KB
-
MD5
bf753a8f83b8813630c4e615e0624699
-
SHA1
16e6eb1ad9c3abe965d5ea0b2102088572d68de5
-
SHA256
2db396f22d7707b7396738c672e94f0063fec498aa1c8e6f2277b229e743d898
-
SHA512
360ad01212f914fddebf6101569364c86eefd03fb31f4a273b6995f44e9834b022ded1c6f60bc87e461229ec61d0744d9c9b083a4857e8ec6e8c86711ed8cd21
-
SSDEEP
12288:NU5rCOTeijhu1Hiv8EeUqw2ELVMiTxACZ8zTZwlH4Hp:NUQOJj8IeY2ELqYHOTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1544 46CD.tmp 4560 4779.tmp 3908 47F6.tmp 2216 4863.tmp 3144 48D0.tmp 2932 493E.tmp 3020 49CA.tmp 1360 4A38.tmp 1912 4AF3.tmp 2872 4B61.tmp 4348 4BFD.tmp 1588 4C6A.tmp 1528 4CE7.tmp 724 4D74.tmp 2364 4DC2.tmp 392 4E2F.tmp 3924 4EBC.tmp 3344 4F39.tmp 1672 4F97.tmp 1592 5023.tmp 3672 5081.tmp 844 510E.tmp 1644 519A.tmp 2876 5227.tmp 3148 52A4.tmp 3848 5340.tmp 2032 53BD.tmp 4800 542B.tmp 2336 54B7.tmp 1180 5554.tmp 4224 55B1.tmp 4588 561F.tmp 2156 56DA.tmp 4444 5728.tmp 4216 5786.tmp 4044 57E4.tmp 1804 5842.tmp 1752 589F.tmp 3756 590D.tmp 1848 596A.tmp 428 59D8.tmp 2232 5A36.tmp 2892 5A93.tmp 3060 5AE1.tmp 3000 5B3F.tmp 1268 5B8D.tmp 2736 5BFB.tmp 4920 5C58.tmp 2476 5CB6.tmp 2316 5D14.tmp 3080 5D81.tmp 3368 5DDF.tmp 2804 5E3D.tmp 2240 5E9B.tmp 3200 5EF8.tmp 1588 5F66.tmp 3420 5FC3.tmp 724 6021.tmp 4352 607F.tmp 4472 60DD.tmp 4000 613A.tmp 3812 6198.tmp 1556 6206.tmp 1672 6263.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 1544 4468 2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe 82 PID 4468 wrote to memory of 1544 4468 2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe 82 PID 4468 wrote to memory of 1544 4468 2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe 82 PID 1544 wrote to memory of 4560 1544 46CD.tmp 83 PID 1544 wrote to memory of 4560 1544 46CD.tmp 83 PID 1544 wrote to memory of 4560 1544 46CD.tmp 83 PID 4560 wrote to memory of 3908 4560 4779.tmp 85 PID 4560 wrote to memory of 3908 4560 4779.tmp 85 PID 4560 wrote to memory of 3908 4560 4779.tmp 85 PID 3908 wrote to memory of 2216 3908 47F6.tmp 86 PID 3908 wrote to memory of 2216 3908 47F6.tmp 86 PID 3908 wrote to memory of 2216 3908 47F6.tmp 86 PID 2216 wrote to memory of 3144 2216 4863.tmp 88 PID 2216 wrote to memory of 3144 2216 4863.tmp 88 PID 2216 wrote to memory of 3144 2216 4863.tmp 88 PID 3144 wrote to memory of 2932 3144 48D0.tmp 89 PID 3144 wrote to memory of 2932 3144 48D0.tmp 89 PID 3144 wrote to memory of 2932 3144 48D0.tmp 89 PID 2932 wrote to memory of 3020 2932 493E.tmp 91 PID 2932 wrote to memory of 3020 2932 493E.tmp 91 PID 2932 wrote to memory of 3020 2932 493E.tmp 91 PID 3020 wrote to memory of 1360 3020 49CA.tmp 92 PID 3020 wrote to memory of 1360 3020 49CA.tmp 92 PID 3020 wrote to memory of 1360 3020 49CA.tmp 92 PID 1360 wrote to memory of 1912 1360 4A38.tmp 93 PID 1360 wrote to memory of 1912 1360 4A38.tmp 93 PID 1360 wrote to memory of 1912 1360 4A38.tmp 93 PID 1912 wrote to memory of 2872 1912 4AF3.tmp 94 PID 1912 wrote to memory of 2872 1912 4AF3.tmp 94 PID 1912 wrote to memory of 2872 1912 4AF3.tmp 94 PID 2872 wrote to memory of 4348 2872 4B61.tmp 95 PID 2872 wrote to memory of 4348 2872 4B61.tmp 95 PID 2872 wrote to memory of 4348 2872 4B61.tmp 95 PID 4348 wrote to memory of 1588 4348 4BFD.tmp 96 PID 4348 wrote to memory of 1588 4348 4BFD.tmp 96 PID 4348 wrote to memory of 1588 4348 4BFD.tmp 96 PID 1588 wrote to memory of 1528 1588 4C6A.tmp 97 PID 1588 wrote to memory of 1528 1588 4C6A.tmp 97 PID 1588 wrote to memory of 1528 1588 4C6A.tmp 97 PID 1528 wrote to memory of 724 1528 4CE7.tmp 98 PID 1528 wrote to memory of 724 1528 4CE7.tmp 98 PID 1528 wrote to memory of 724 1528 4CE7.tmp 98 PID 724 wrote to memory of 2364 724 4D74.tmp 99 PID 724 wrote to memory of 2364 724 4D74.tmp 99 PID 724 wrote to memory of 2364 724 4D74.tmp 99 PID 2364 wrote to memory of 392 2364 4DC2.tmp 100 PID 2364 wrote to memory of 392 2364 4DC2.tmp 100 PID 2364 wrote to memory of 392 2364 4DC2.tmp 100 PID 392 wrote to memory of 3924 392 4E2F.tmp 101 PID 392 wrote to memory of 3924 392 4E2F.tmp 101 PID 392 wrote to memory of 3924 392 4E2F.tmp 101 PID 3924 wrote to memory of 3344 3924 4EBC.tmp 102 PID 3924 wrote to memory of 3344 3924 4EBC.tmp 102 PID 3924 wrote to memory of 3344 3924 4EBC.tmp 102 PID 3344 wrote to memory of 1672 3344 4F39.tmp 103 PID 3344 wrote to memory of 1672 3344 4F39.tmp 103 PID 3344 wrote to memory of 1672 3344 4F39.tmp 103 PID 1672 wrote to memory of 1592 1672 4F97.tmp 104 PID 1672 wrote to memory of 1592 1672 4F97.tmp 104 PID 1672 wrote to memory of 1592 1672 4F97.tmp 104 PID 1592 wrote to memory of 3672 1592 5023.tmp 105 PID 1592 wrote to memory of 3672 1592 5023.tmp 105 PID 1592 wrote to memory of 3672 1592 5023.tmp 105 PID 3672 wrote to memory of 844 3672 5081.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_bf753a8f83b8813630c4e615e0624699_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"23⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"24⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"25⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"26⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"27⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"28⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"29⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"30⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"31⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"32⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"33⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"34⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"35⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"36⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"37⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"38⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"39⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"40⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"41⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"42⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"43⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"44⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"45⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"46⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"47⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"48⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"49⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"50⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"51⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"52⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"53⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"54⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"55⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"56⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"57⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"58⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"59⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"60⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"61⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"62⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"63⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"64⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"65⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"66⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"67⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"68⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"69⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"70⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"72⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"73⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"74⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"75⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"76⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"78⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"79⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"80⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"81⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"82⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"84⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"85⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"86⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"87⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"88⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"89⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"90⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"91⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"92⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"94⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"95⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"96⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"97⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"98⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"99⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"100⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"101⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"102⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"103⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"104⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"105⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"106⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"107⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"108⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"110⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"111⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"112⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"113⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"114⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"115⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"116⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"117⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"118⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"119⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"120⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"121⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-