Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe
-
Size
486KB
-
MD5
ac80523978dd65892dcbd460332e6dcc
-
SHA1
70b422c525a671c6d6def6d604af88b0d075f9d6
-
SHA256
ec258415f8157fe99f34b119d9a41f98e4b960d25628bf6ad620428bbeca946f
-
SHA512
83200ac9e2642a33cead762a696eecb62dc2d7b0c718ff414fa267cf25e259b872d30cea199b5e465810ddd5c45cc7308687bafd550e02d2dbbb7245a0e53cd5
-
SSDEEP
12288:UU5rCOTeiDoDNjOkMILo+oa6wNxYb7NZ:UUQOJDAjOk/0wNCN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3460 74A3.tmp 1828 757E.tmp 2196 762A.tmp 4660 76D6.tmp 3304 7762.tmp 708 781E.tmp 1372 7918.tmp 1660 79D3.tmp 4612 7A70.tmp 2948 7B6A.tmp 4408 7C25.tmp 1460 7D0F.tmp 3372 7D8C.tmp 1768 7E38.tmp 3820 7EF4.tmp 3780 7FBF.tmp 840 80A9.tmp 3600 8165.tmp 4180 8240.tmp 3288 832A.tmp 4844 84D0.tmp 1760 859B.tmp 4516 8666.tmp 4232 8722.tmp 4428 87FC.tmp 3136 88A8.tmp 3424 8964.tmp 4244 8A4E.tmp 1256 8B0A.tmp 3768 8BD5.tmp 620 8C71.tmp 3104 8CEE.tmp 2952 8DC9.tmp 2020 8E65.tmp 2920 8EF2.tmp 4936 8F7E.tmp 3808 8FFB.tmp 2872 9069.tmp 4736 90D6.tmp 5084 9163.tmp 3736 91E0.tmp 3212 927C.tmp 4360 9318.tmp 4000 9385.tmp 3728 9412.tmp 832 949F.tmp 2472 953B.tmp 4452 95C8.tmp 2208 9635.tmp 3140 96B2.tmp 4860 97AC.tmp 1200 9829.tmp 1280 9952.tmp 4160 99CF.tmp 2196 9A4C.tmp 4932 9AC9.tmp 2680 9B36.tmp 3112 9BA4.tmp 708 9C4F.tmp 2332 9CBD.tmp 2564 9D49.tmp 456 9DC6.tmp 1636 9E34.tmp 2536 9E92.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 3460 1324 2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe 84 PID 1324 wrote to memory of 3460 1324 2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe 84 PID 1324 wrote to memory of 3460 1324 2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe 84 PID 3460 wrote to memory of 1828 3460 74A3.tmp 85 PID 3460 wrote to memory of 1828 3460 74A3.tmp 85 PID 3460 wrote to memory of 1828 3460 74A3.tmp 85 PID 1828 wrote to memory of 2196 1828 757E.tmp 86 PID 1828 wrote to memory of 2196 1828 757E.tmp 86 PID 1828 wrote to memory of 2196 1828 757E.tmp 86 PID 2196 wrote to memory of 4660 2196 762A.tmp 87 PID 2196 wrote to memory of 4660 2196 762A.tmp 87 PID 2196 wrote to memory of 4660 2196 762A.tmp 87 PID 4660 wrote to memory of 3304 4660 76D6.tmp 88 PID 4660 wrote to memory of 3304 4660 76D6.tmp 88 PID 4660 wrote to memory of 3304 4660 76D6.tmp 88 PID 3304 wrote to memory of 708 3304 7762.tmp 89 PID 3304 wrote to memory of 708 3304 7762.tmp 89 PID 3304 wrote to memory of 708 3304 7762.tmp 89 PID 708 wrote to memory of 1372 708 781E.tmp 90 PID 708 wrote to memory of 1372 708 781E.tmp 90 PID 708 wrote to memory of 1372 708 781E.tmp 90 PID 1372 wrote to memory of 1660 1372 7918.tmp 91 PID 1372 wrote to memory of 1660 1372 7918.tmp 91 PID 1372 wrote to memory of 1660 1372 7918.tmp 91 PID 1660 wrote to memory of 4612 1660 79D3.tmp 92 PID 1660 wrote to memory of 4612 1660 79D3.tmp 92 PID 1660 wrote to memory of 4612 1660 79D3.tmp 92 PID 4612 wrote to memory of 2948 4612 7A70.tmp 93 PID 4612 wrote to memory of 2948 4612 7A70.tmp 93 PID 4612 wrote to memory of 2948 4612 7A70.tmp 93 PID 2948 wrote to memory of 4408 2948 7B6A.tmp 94 PID 2948 wrote to memory of 4408 2948 7B6A.tmp 94 PID 2948 wrote to memory of 4408 2948 7B6A.tmp 94 PID 4408 wrote to memory of 1460 4408 7C25.tmp 95 PID 4408 wrote to memory of 1460 4408 7C25.tmp 95 PID 4408 wrote to memory of 1460 4408 7C25.tmp 95 PID 1460 wrote to memory of 3372 1460 7D0F.tmp 96 PID 1460 wrote to memory of 3372 1460 7D0F.tmp 96 PID 1460 wrote to memory of 3372 1460 7D0F.tmp 96 PID 3372 wrote to memory of 1768 3372 7D8C.tmp 97 PID 3372 wrote to memory of 1768 3372 7D8C.tmp 97 PID 3372 wrote to memory of 1768 3372 7D8C.tmp 97 PID 1768 wrote to memory of 3820 1768 7E38.tmp 98 PID 1768 wrote to memory of 3820 1768 7E38.tmp 98 PID 1768 wrote to memory of 3820 1768 7E38.tmp 98 PID 3820 wrote to memory of 3780 3820 7EF4.tmp 99 PID 3820 wrote to memory of 3780 3820 7EF4.tmp 99 PID 3820 wrote to memory of 3780 3820 7EF4.tmp 99 PID 3780 wrote to memory of 840 3780 7FBF.tmp 100 PID 3780 wrote to memory of 840 3780 7FBF.tmp 100 PID 3780 wrote to memory of 840 3780 7FBF.tmp 100 PID 840 wrote to memory of 3600 840 80A9.tmp 101 PID 840 wrote to memory of 3600 840 80A9.tmp 101 PID 840 wrote to memory of 3600 840 80A9.tmp 101 PID 3600 wrote to memory of 4180 3600 8165.tmp 102 PID 3600 wrote to memory of 4180 3600 8165.tmp 102 PID 3600 wrote to memory of 4180 3600 8165.tmp 102 PID 4180 wrote to memory of 3288 4180 8240.tmp 103 PID 4180 wrote to memory of 3288 4180 8240.tmp 103 PID 4180 wrote to memory of 3288 4180 8240.tmp 103 PID 3288 wrote to memory of 4844 3288 832A.tmp 104 PID 3288 wrote to memory of 4844 3288 832A.tmp 104 PID 3288 wrote to memory of 4844 3288 832A.tmp 104 PID 4844 wrote to memory of 1760 4844 84D0.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_ac80523978dd65892dcbd460332e6dcc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"23⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"24⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"25⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"26⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"27⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"28⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"29⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"30⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"31⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"32⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"33⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"34⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"35⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"36⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"37⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"38⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"39⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"40⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"41⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"42⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"43⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"44⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"45⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"46⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"47⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"48⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"49⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"50⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"51⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"52⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"53⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"54⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"55⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"56⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"57⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"58⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"59⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"60⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"61⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"62⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"63⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"64⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"65⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"66⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"67⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"68⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"69⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"70⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"71⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"72⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"73⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"74⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"75⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"76⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"77⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"78⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"79⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"80⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"81⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"82⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"83⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"84⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"85⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"86⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"88⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"89⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"90⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"91⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"92⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"93⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"94⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"95⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"96⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"97⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"98⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"99⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"100⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"101⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"102⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"103⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"104⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"105⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"106⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"107⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"108⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"109⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"110⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"111⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"112⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"113⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"114⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"115⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"116⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"117⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"118⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"120⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"121⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-