Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe
-
Size
486KB
-
MD5
b5d93ec721c8e8cf5991af131fee64aa
-
SHA1
08080484022614e2f170f40ebca12e8a345cc268
-
SHA256
03de6078d28220ff59beacd0c7e2ae451ff9c9d6742f0f9224f5a324113be5c3
-
SHA512
9690e5a16ed5bd06ea46b13ca2cb4db8d4fbe9078fd3abf388ccd8b24944692512af62313c4027b15c6ed315eae423008022faf7d7aafcda318c8a607ea42044
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7iUZZC1koo9tGKfhtei70FdKvEYNlzEaiVgsU:/U5rCOTeiD5ZMk1rF0q0X5YHsgffNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4340 6C18.tmp 4092 6CB4.tmp 440 6D6F.tmp 1580 6E89.tmp 2856 6F63.tmp 4108 700F.tmp 2084 70FA.tmp 4324 71B5.tmp 116 7271.tmp 1404 732C.tmp 2432 73E8.tmp 1484 7455.tmp 2852 74D2.tmp 3312 755F.tmp 1340 75EB.tmp 3656 7678.tmp 2188 7733.tmp 1272 77A1.tmp 2500 781E.tmp 1912 78AA.tmp 4212 7956.tmp 4808 7A70.tmp 1492 7B2B.tmp 3764 7BA8.tmp 2696 7C54.tmp 4620 7D00.tmp 4036 7D6D.tmp 4516 7E38.tmp 3516 7ED5.tmp 3920 7F71.tmp 316 801D.tmp 4364 809A.tmp 3020 8136.tmp 3108 81B3.tmp 4644 824F.tmp 4716 82DC.tmp 4496 8397.tmp 1428 8414.tmp 4776 84C0.tmp 324 854D.tmp 4920 85F9.tmp 4580 8695.tmp 2668 8731.tmp 2824 87CD.tmp 644 8879.tmp 2664 8906.tmp 3596 8983.tmp 3472 8A1F.tmp 4108 8A9C.tmp 4088 8B29.tmp 4472 8BB5.tmp 2708 8C32.tmp 1184 8CDE.tmp 2160 8D7B.tmp 816 8E07.tmp 1260 8E84.tmp 1484 8F01.tmp 2868 8F8E.tmp 3344 900B.tmp 3312 9097.tmp 1420 9134.tmp 624 91A1.tmp 4744 922E.tmp 2188 92DA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4340 4156 2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe 86 PID 4156 wrote to memory of 4340 4156 2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe 86 PID 4156 wrote to memory of 4340 4156 2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe 86 PID 4340 wrote to memory of 4092 4340 6C18.tmp 87 PID 4340 wrote to memory of 4092 4340 6C18.tmp 87 PID 4340 wrote to memory of 4092 4340 6C18.tmp 87 PID 4092 wrote to memory of 440 4092 6CB4.tmp 89 PID 4092 wrote to memory of 440 4092 6CB4.tmp 89 PID 4092 wrote to memory of 440 4092 6CB4.tmp 89 PID 440 wrote to memory of 1580 440 6D6F.tmp 90 PID 440 wrote to memory of 1580 440 6D6F.tmp 90 PID 440 wrote to memory of 1580 440 6D6F.tmp 90 PID 1580 wrote to memory of 2856 1580 6E89.tmp 91 PID 1580 wrote to memory of 2856 1580 6E89.tmp 91 PID 1580 wrote to memory of 2856 1580 6E89.tmp 91 PID 2856 wrote to memory of 4108 2856 6F63.tmp 92 PID 2856 wrote to memory of 4108 2856 6F63.tmp 92 PID 2856 wrote to memory of 4108 2856 6F63.tmp 92 PID 4108 wrote to memory of 2084 4108 700F.tmp 93 PID 4108 wrote to memory of 2084 4108 700F.tmp 93 PID 4108 wrote to memory of 2084 4108 700F.tmp 93 PID 2084 wrote to memory of 4324 2084 70FA.tmp 94 PID 2084 wrote to memory of 4324 2084 70FA.tmp 94 PID 2084 wrote to memory of 4324 2084 70FA.tmp 94 PID 4324 wrote to memory of 116 4324 71B5.tmp 95 PID 4324 wrote to memory of 116 4324 71B5.tmp 95 PID 4324 wrote to memory of 116 4324 71B5.tmp 95 PID 116 wrote to memory of 1404 116 7271.tmp 96 PID 116 wrote to memory of 1404 116 7271.tmp 96 PID 116 wrote to memory of 1404 116 7271.tmp 96 PID 1404 wrote to memory of 2432 1404 732C.tmp 97 PID 1404 wrote to memory of 2432 1404 732C.tmp 97 PID 1404 wrote to memory of 2432 1404 732C.tmp 97 PID 2432 wrote to memory of 1484 2432 73E8.tmp 98 PID 2432 wrote to memory of 1484 2432 73E8.tmp 98 PID 2432 wrote to memory of 1484 2432 73E8.tmp 98 PID 1484 wrote to memory of 2852 1484 7455.tmp 99 PID 1484 wrote to memory of 2852 1484 7455.tmp 99 PID 1484 wrote to memory of 2852 1484 7455.tmp 99 PID 2852 wrote to memory of 3312 2852 74D2.tmp 100 PID 2852 wrote to memory of 3312 2852 74D2.tmp 100 PID 2852 wrote to memory of 3312 2852 74D2.tmp 100 PID 3312 wrote to memory of 1340 3312 755F.tmp 101 PID 3312 wrote to memory of 1340 3312 755F.tmp 101 PID 3312 wrote to memory of 1340 3312 755F.tmp 101 PID 1340 wrote to memory of 3656 1340 75EB.tmp 102 PID 1340 wrote to memory of 3656 1340 75EB.tmp 102 PID 1340 wrote to memory of 3656 1340 75EB.tmp 102 PID 3656 wrote to memory of 2188 3656 7678.tmp 103 PID 3656 wrote to memory of 2188 3656 7678.tmp 103 PID 3656 wrote to memory of 2188 3656 7678.tmp 103 PID 2188 wrote to memory of 1272 2188 7733.tmp 104 PID 2188 wrote to memory of 1272 2188 7733.tmp 104 PID 2188 wrote to memory of 1272 2188 7733.tmp 104 PID 1272 wrote to memory of 2500 1272 77A1.tmp 105 PID 1272 wrote to memory of 2500 1272 77A1.tmp 105 PID 1272 wrote to memory of 2500 1272 77A1.tmp 105 PID 2500 wrote to memory of 1912 2500 781E.tmp 106 PID 2500 wrote to memory of 1912 2500 781E.tmp 106 PID 2500 wrote to memory of 1912 2500 781E.tmp 106 PID 1912 wrote to memory of 4212 1912 78AA.tmp 107 PID 1912 wrote to memory of 4212 1912 78AA.tmp 107 PID 1912 wrote to memory of 4212 1912 78AA.tmp 107 PID 4212 wrote to memory of 4808 4212 7956.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_b5d93ec721c8e8cf5991af131fee64aa_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"23⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"24⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"25⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"26⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"27⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"28⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"29⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"30⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"31⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"32⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"33⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"34⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"35⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"36⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"37⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"38⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"39⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"40⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"41⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"42⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"43⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"44⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"45⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"46⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"47⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"48⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"49⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"50⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"51⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"53⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"54⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"55⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"56⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"57⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"58⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"59⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"60⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"61⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"62⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"63⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"64⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"65⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"66⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"67⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"68⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"69⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"70⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"71⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"72⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"73⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"74⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"75⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"76⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"77⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"78⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"79⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"80⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"81⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"82⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"83⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"84⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"85⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"87⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"88⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"90⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"91⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"92⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"93⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"94⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"95⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"97⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"98⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"99⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"100⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"101⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"102⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"103⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"104⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"105⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"106⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"107⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"108⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"109⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"110⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"111⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"112⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"113⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"114⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"115⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"117⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"119⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"120⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"122⤵PID:3844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-