Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
-
Size
486KB
-
MD5
f1c3a04d2113c7864123141b9507e10d
-
SHA1
fabdf319e1b2c74a5af813a83a6a17161a36538f
-
SHA256
a06d9c84125ba68780ad0451d2364064f6793c79ebab70080f6f736180e6e45d
-
SHA512
6bbe254e063339dfe1bd1cfa57aed0e2e89afd43c558a8d6911c52eb08d75f212b5301de0aff614f0833be047de6a3f462c86cfe9196bcf42b3bbaf797f31ae0
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7C55KSIpeyZ+4n9k/7g2TMeIcNUepY8sH3dZ:/U5rCOTeiDCnysFznMNcNANZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3024 562E.tmp 232 56BB.tmp 4932 5748.tmp 5004 5803.tmp 1648 5880.tmp 2356 58ED.tmp 2740 596A.tmp 4416 59E7.tmp 628 5A74.tmp 5116 5B20.tmp 4624 5BAD.tmp 4772 5C49.tmp 3440 5CE5.tmp 1720 5D81.tmp 3796 5DDF.tmp 5024 5E5C.tmp 3640 5EC9.tmp 1944 5F37.tmp 4656 5FD3.tmp 3156 6040.tmp 4912 60BD.tmp 4372 613A.tmp 5108 61A8.tmp 4840 6225.tmp 2800 6292.tmp 1540 630F.tmp 2784 63AB.tmp 3496 6419.tmp 1192 6496.tmp 4636 6503.tmp 2084 6561.tmp 5080 65EE.tmp 4420 667A.tmp 852 66D8.tmp 5000 6745.tmp 1308 67A3.tmp 2448 6810.tmp 4336 687E.tmp 1168 68CC.tmp 1216 692A.tmp 216 6987.tmp 3024 69F5.tmp 1376 6A62.tmp 2364 6AD0.tmp 2420 6B1E.tmp 1152 6B7B.tmp 1396 6BD9.tmp 4932 6C47.tmp 1676 6C95.tmp 5052 6CF2.tmp 652 6D60.tmp 1324 6DCD.tmp 400 6E2B.tmp 3236 6E89.tmp 4308 6EE6.tmp 832 6F44.tmp 1156 6F92.tmp 3000 6FE0.tmp 1552 703E.tmp 1740 709C.tmp 4092 70EA.tmp 2280 7148.tmp 4672 71A6.tmp 948 7213.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3024 3876 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 88 PID 3876 wrote to memory of 3024 3876 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 88 PID 3876 wrote to memory of 3024 3876 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 88 PID 3024 wrote to memory of 232 3024 562E.tmp 89 PID 3024 wrote to memory of 232 3024 562E.tmp 89 PID 3024 wrote to memory of 232 3024 562E.tmp 89 PID 232 wrote to memory of 4932 232 56BB.tmp 91 PID 232 wrote to memory of 4932 232 56BB.tmp 91 PID 232 wrote to memory of 4932 232 56BB.tmp 91 PID 4932 wrote to memory of 5004 4932 5748.tmp 93 PID 4932 wrote to memory of 5004 4932 5748.tmp 93 PID 4932 wrote to memory of 5004 4932 5748.tmp 93 PID 5004 wrote to memory of 1648 5004 5803.tmp 95 PID 5004 wrote to memory of 1648 5004 5803.tmp 95 PID 5004 wrote to memory of 1648 5004 5803.tmp 95 PID 1648 wrote to memory of 2356 1648 5880.tmp 96 PID 1648 wrote to memory of 2356 1648 5880.tmp 96 PID 1648 wrote to memory of 2356 1648 5880.tmp 96 PID 2356 wrote to memory of 2740 2356 58ED.tmp 97 PID 2356 wrote to memory of 2740 2356 58ED.tmp 97 PID 2356 wrote to memory of 2740 2356 58ED.tmp 97 PID 2740 wrote to memory of 4416 2740 596A.tmp 98 PID 2740 wrote to memory of 4416 2740 596A.tmp 98 PID 2740 wrote to memory of 4416 2740 596A.tmp 98 PID 4416 wrote to memory of 628 4416 59E7.tmp 99 PID 4416 wrote to memory of 628 4416 59E7.tmp 99 PID 4416 wrote to memory of 628 4416 59E7.tmp 99 PID 628 wrote to memory of 5116 628 5A74.tmp 100 PID 628 wrote to memory of 5116 628 5A74.tmp 100 PID 628 wrote to memory of 5116 628 5A74.tmp 100 PID 5116 wrote to memory of 4624 5116 5B20.tmp 101 PID 5116 wrote to memory of 4624 5116 5B20.tmp 101 PID 5116 wrote to memory of 4624 5116 5B20.tmp 101 PID 4624 wrote to memory of 4772 4624 5BAD.tmp 102 PID 4624 wrote to memory of 4772 4624 5BAD.tmp 102 PID 4624 wrote to memory of 4772 4624 5BAD.tmp 102 PID 4772 wrote to memory of 3440 4772 5C49.tmp 103 PID 4772 wrote to memory of 3440 4772 5C49.tmp 103 PID 4772 wrote to memory of 3440 4772 5C49.tmp 103 PID 3440 wrote to memory of 1720 3440 5CE5.tmp 104 PID 3440 wrote to memory of 1720 3440 5CE5.tmp 104 PID 3440 wrote to memory of 1720 3440 5CE5.tmp 104 PID 1720 wrote to memory of 3796 1720 5D81.tmp 105 PID 1720 wrote to memory of 3796 1720 5D81.tmp 105 PID 1720 wrote to memory of 3796 1720 5D81.tmp 105 PID 3796 wrote to memory of 5024 3796 5DDF.tmp 106 PID 3796 wrote to memory of 5024 3796 5DDF.tmp 106 PID 3796 wrote to memory of 5024 3796 5DDF.tmp 106 PID 5024 wrote to memory of 3640 5024 5E5C.tmp 107 PID 5024 wrote to memory of 3640 5024 5E5C.tmp 107 PID 5024 wrote to memory of 3640 5024 5E5C.tmp 107 PID 3640 wrote to memory of 1944 3640 5EC9.tmp 108 PID 3640 wrote to memory of 1944 3640 5EC9.tmp 108 PID 3640 wrote to memory of 1944 3640 5EC9.tmp 108 PID 1944 wrote to memory of 4656 1944 5F37.tmp 109 PID 1944 wrote to memory of 4656 1944 5F37.tmp 109 PID 1944 wrote to memory of 4656 1944 5F37.tmp 109 PID 4656 wrote to memory of 3156 4656 5FD3.tmp 110 PID 4656 wrote to memory of 3156 4656 5FD3.tmp 110 PID 4656 wrote to memory of 3156 4656 5FD3.tmp 110 PID 3156 wrote to memory of 4912 3156 6040.tmp 111 PID 3156 wrote to memory of 4912 3156 6040.tmp 111 PID 3156 wrote to memory of 4912 3156 6040.tmp 111 PID 4912 wrote to memory of 4372 4912 60BD.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"23⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"24⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"25⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"26⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"27⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"28⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"29⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"30⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"31⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"32⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"33⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"34⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"35⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"36⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"37⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"38⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"39⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"40⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"41⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"42⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"43⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"44⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"45⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"46⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"47⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"48⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"49⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"50⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"51⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"52⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"53⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"54⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"55⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"56⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"57⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"58⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"59⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"60⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"61⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"62⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"63⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"64⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"65⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"66⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"67⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"68⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"69⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"70⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"71⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"72⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"73⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"74⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"75⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"76⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"77⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"78⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"79⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"80⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"81⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"82⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"83⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"84⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"85⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"86⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"87⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"88⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"89⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"90⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"91⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"92⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"93⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"94⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"95⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"96⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"97⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"98⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"99⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"100⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"101⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"102⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"103⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"104⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"105⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"106⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"107⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"108⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"109⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"110⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"111⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"112⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"113⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"114⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"115⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"117⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"118⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"120⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"121⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-