Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe
-
Size
486KB
-
MD5
19b4b7d5f75b8c0c22bfb0f005fb98bc
-
SHA1
3bb989270532d4c0715ad2481e5f8737f73dea42
-
SHA256
c9c96e7be24034a79978b5152cabf6aed1fb2cf5975e67f6f344423890dd51cf
-
SHA512
1829cc3e01a39b4bb8903b699436878c28ccaf6370d368dd4999f2a093ac642baf3e24c9d2538cae5d694564983abe783b9a4c26b9103d9eb812d8b5e168d3dc
-
SSDEEP
12288:oU5rCOTeiDuPc/lCmznvg5uMjmm1vF6x7cNZ:oUQOJDDAmzn45uMxt6dcN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4500 48C1.tmp 1964 491F.tmp 3872 498C.tmp 468 4AE4.tmp 2380 4B61.tmp 3356 4BBE.tmp 4616 4C0D.tmp 2792 4C7A.tmp 440 4CD8.tmp 644 4D26.tmp 2324 4D93.tmp 520 4DF1.tmp 4076 4E5E.tmp 5116 4ECC.tmp 668 4F29.tmp 4228 4F97.tmp 1864 4FE5.tmp 4456 5033.tmp 560 5081.tmp 3856 50EF.tmp 2084 513D.tmp 3712 518B.tmp 3024 51D9.tmp 2388 5237.tmp 2244 52B4.tmp 4212 5321.tmp 596 538E.tmp 2848 53EC.tmp 3612 545A.tmp 3916 54A8.tmp 4676 5525.tmp 1804 5573.tmp 1308 55E0.tmp 3136 562E.tmp 2672 567C.tmp 4548 56CB.tmp 1680 5719.tmp 232 5767.tmp 564 57B5.tmp 4472 5803.tmp 4460 5851.tmp 3084 589F.tmp 2788 58ED.tmp 220 594B.tmp 1964 59A9.tmp 4912 59F7.tmp 2832 5A55.tmp 5016 5AA3.tmp 3484 5AF1.tmp 1392 5B4F.tmp 4188 5B9D.tmp 5036 5BEB.tmp 2988 5C49.tmp 4800 5CA7.tmp 4760 5CF5.tmp 3144 5D43.tmp 3868 5D91.tmp 644 5DDF.tmp 3388 5E3D.tmp 8 5E8B.tmp 1508 5ED9.tmp 3736 5F27.tmp 3020 5F75.tmp 1468 5FC3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 4500 408 2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe 86 PID 408 wrote to memory of 4500 408 2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe 86 PID 408 wrote to memory of 4500 408 2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe 86 PID 4500 wrote to memory of 1964 4500 48C1.tmp 87 PID 4500 wrote to memory of 1964 4500 48C1.tmp 87 PID 4500 wrote to memory of 1964 4500 48C1.tmp 87 PID 1964 wrote to memory of 3872 1964 491F.tmp 88 PID 1964 wrote to memory of 3872 1964 491F.tmp 88 PID 1964 wrote to memory of 3872 1964 491F.tmp 88 PID 3872 wrote to memory of 468 3872 498C.tmp 89 PID 3872 wrote to memory of 468 3872 498C.tmp 89 PID 3872 wrote to memory of 468 3872 498C.tmp 89 PID 468 wrote to memory of 2380 468 4AE4.tmp 90 PID 468 wrote to memory of 2380 468 4AE4.tmp 90 PID 468 wrote to memory of 2380 468 4AE4.tmp 90 PID 2380 wrote to memory of 3356 2380 4B61.tmp 91 PID 2380 wrote to memory of 3356 2380 4B61.tmp 91 PID 2380 wrote to memory of 3356 2380 4B61.tmp 91 PID 3356 wrote to memory of 4616 3356 4BBE.tmp 92 PID 3356 wrote to memory of 4616 3356 4BBE.tmp 92 PID 3356 wrote to memory of 4616 3356 4BBE.tmp 92 PID 4616 wrote to memory of 2792 4616 4C0D.tmp 93 PID 4616 wrote to memory of 2792 4616 4C0D.tmp 93 PID 4616 wrote to memory of 2792 4616 4C0D.tmp 93 PID 2792 wrote to memory of 440 2792 4C7A.tmp 94 PID 2792 wrote to memory of 440 2792 4C7A.tmp 94 PID 2792 wrote to memory of 440 2792 4C7A.tmp 94 PID 440 wrote to memory of 644 440 4CD8.tmp 95 PID 440 wrote to memory of 644 440 4CD8.tmp 95 PID 440 wrote to memory of 644 440 4CD8.tmp 95 PID 644 wrote to memory of 2324 644 4D26.tmp 96 PID 644 wrote to memory of 2324 644 4D26.tmp 96 PID 644 wrote to memory of 2324 644 4D26.tmp 96 PID 2324 wrote to memory of 520 2324 4D93.tmp 97 PID 2324 wrote to memory of 520 2324 4D93.tmp 97 PID 2324 wrote to memory of 520 2324 4D93.tmp 97 PID 520 wrote to memory of 4076 520 4DF1.tmp 98 PID 520 wrote to memory of 4076 520 4DF1.tmp 98 PID 520 wrote to memory of 4076 520 4DF1.tmp 98 PID 4076 wrote to memory of 5116 4076 4E5E.tmp 99 PID 4076 wrote to memory of 5116 4076 4E5E.tmp 99 PID 4076 wrote to memory of 5116 4076 4E5E.tmp 99 PID 5116 wrote to memory of 668 5116 4ECC.tmp 100 PID 5116 wrote to memory of 668 5116 4ECC.tmp 100 PID 5116 wrote to memory of 668 5116 4ECC.tmp 100 PID 668 wrote to memory of 4228 668 4F29.tmp 101 PID 668 wrote to memory of 4228 668 4F29.tmp 101 PID 668 wrote to memory of 4228 668 4F29.tmp 101 PID 4228 wrote to memory of 1864 4228 4F97.tmp 102 PID 4228 wrote to memory of 1864 4228 4F97.tmp 102 PID 4228 wrote to memory of 1864 4228 4F97.tmp 102 PID 1864 wrote to memory of 4456 1864 4FE5.tmp 103 PID 1864 wrote to memory of 4456 1864 4FE5.tmp 103 PID 1864 wrote to memory of 4456 1864 4FE5.tmp 103 PID 4456 wrote to memory of 560 4456 5033.tmp 104 PID 4456 wrote to memory of 560 4456 5033.tmp 104 PID 4456 wrote to memory of 560 4456 5033.tmp 104 PID 560 wrote to memory of 3856 560 5081.tmp 105 PID 560 wrote to memory of 3856 560 5081.tmp 105 PID 560 wrote to memory of 3856 560 5081.tmp 105 PID 3856 wrote to memory of 2084 3856 50EF.tmp 106 PID 3856 wrote to memory of 2084 3856 50EF.tmp 106 PID 3856 wrote to memory of 2084 3856 50EF.tmp 106 PID 2084 wrote to memory of 3712 2084 513D.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_19b4b7d5f75b8c0c22bfb0f005fb98bc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"23⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"24⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"25⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"26⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"27⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"28⤵
- Executes dropped EXE
PID:596 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"29⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"30⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"31⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"32⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"33⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"34⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"35⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"36⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"37⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"38⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"39⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"40⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"41⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"42⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"43⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"44⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"45⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"46⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"47⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"48⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"49⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"50⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"51⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"52⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"53⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"54⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"55⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"56⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"57⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"58⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"59⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"60⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"61⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"62⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"63⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"64⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"65⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"66⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"67⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"68⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"69⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"70⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"71⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"72⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"73⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"74⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"75⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"76⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"77⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"78⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"79⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"80⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"81⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"82⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"83⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"84⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"85⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"86⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"87⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"88⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"89⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"90⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"91⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"92⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"93⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"94⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"95⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"96⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"97⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"98⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"99⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"100⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"101⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"102⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"103⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"104⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"106⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"107⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"108⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"109⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"110⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"111⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"112⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"113⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"114⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"115⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"116⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"117⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"119⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"120⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"121⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-