Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 20:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
-
Size
520KB
-
MD5
d685d9a0c2f948366d5be46f29bb9394
-
SHA1
2b8ca70912d3021bc465f8bfc08c2e6c81235159
-
SHA256
11e4085c0e17bd26cb971f68d06109d0e42c099e630c09fa3782e77279ea4b3e
-
SHA512
a727eb9b9ca5764eb67c1aa8667bdd1673bd3dd74f67b550d628a1eef747525c9add938da7835e17e3bb7077d4f8d8f403c05ca37b15dc9e142138911582da83
-
SSDEEP
12288:gj8fuxR21t5i8fqRCSVxb33E/8MuzJ15lJVoNZ:gj8fuK1GYqTVxb30/DuzoN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2224 6D6F.tmp 1544 6E89.tmp 5060 6F63.tmp 2796 703E.tmp 4248 70DA.tmp 1240 7157.tmp 1312 7261.tmp 4608 733C.tmp 4760 73B9.tmp 4016 7465.tmp 3644 7520.tmp 2100 7659.tmp 2560 76C6.tmp 3240 7743.tmp 4468 77C0.tmp 3044 784D.tmp 3040 7947.tmp 2284 79A4.tmp 4364 7B0C.tmp 4748 7BE7.tmp 4372 7C83.tmp 4784 7D2F.tmp 3516 7DCB.tmp 2096 7E86.tmp 2784 7F61.tmp 452 803C.tmp 3680 8107.tmp 1284 81C3.tmp 3748 826E.tmp 2080 8368.tmp 4048 84D0.tmp 3308 85CA.tmp 3268 86A5.tmp 3244 8750.tmp 4816 87CD.tmp 4268 886A.tmp 4360 8906.tmp 2104 8993.tmp 4220 8A1F.tmp 4528 8ABB.tmp 4004 8B77.tmp 1520 8C04.tmp 3316 8CAF.tmp 2528 8D1D.tmp 1748 8D9A.tmp 2020 8E36.tmp 2576 8EC3.tmp 1500 8F4F.tmp 3164 8FDC.tmp 2140 9059.tmp 1012 90F5.tmp 1664 9172.tmp 920 91FF.tmp 4092 929B.tmp 4056 9337.tmp 2128 93E3.tmp 2200 947F.tmp 4896 94ED.tmp 4572 95B8.tmp 4536 9635.tmp 744 96E1.tmp 1808 975E.tmp 2860 9819.tmp 828 9896.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 2224 4220 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 86 PID 4220 wrote to memory of 2224 4220 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 86 PID 4220 wrote to memory of 2224 4220 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 86 PID 2224 wrote to memory of 1544 2224 6D6F.tmp 88 PID 2224 wrote to memory of 1544 2224 6D6F.tmp 88 PID 2224 wrote to memory of 1544 2224 6D6F.tmp 88 PID 1544 wrote to memory of 5060 1544 6E89.tmp 90 PID 1544 wrote to memory of 5060 1544 6E89.tmp 90 PID 1544 wrote to memory of 5060 1544 6E89.tmp 90 PID 5060 wrote to memory of 2796 5060 6F63.tmp 91 PID 5060 wrote to memory of 2796 5060 6F63.tmp 91 PID 5060 wrote to memory of 2796 5060 6F63.tmp 91 PID 2796 wrote to memory of 4248 2796 703E.tmp 92 PID 2796 wrote to memory of 4248 2796 703E.tmp 92 PID 2796 wrote to memory of 4248 2796 703E.tmp 92 PID 4248 wrote to memory of 1240 4248 70DA.tmp 93 PID 4248 wrote to memory of 1240 4248 70DA.tmp 93 PID 4248 wrote to memory of 1240 4248 70DA.tmp 93 PID 1240 wrote to memory of 1312 1240 7157.tmp 94 PID 1240 wrote to memory of 1312 1240 7157.tmp 94 PID 1240 wrote to memory of 1312 1240 7157.tmp 94 PID 1312 wrote to memory of 4608 1312 7261.tmp 95 PID 1312 wrote to memory of 4608 1312 7261.tmp 95 PID 1312 wrote to memory of 4608 1312 7261.tmp 95 PID 4608 wrote to memory of 4760 4608 733C.tmp 96 PID 4608 wrote to memory of 4760 4608 733C.tmp 96 PID 4608 wrote to memory of 4760 4608 733C.tmp 96 PID 4760 wrote to memory of 4016 4760 73B9.tmp 97 PID 4760 wrote to memory of 4016 4760 73B9.tmp 97 PID 4760 wrote to memory of 4016 4760 73B9.tmp 97 PID 4016 wrote to memory of 3644 4016 7465.tmp 98 PID 4016 wrote to memory of 3644 4016 7465.tmp 98 PID 4016 wrote to memory of 3644 4016 7465.tmp 98 PID 3644 wrote to memory of 2100 3644 7520.tmp 99 PID 3644 wrote to memory of 2100 3644 7520.tmp 99 PID 3644 wrote to memory of 2100 3644 7520.tmp 99 PID 2100 wrote to memory of 2560 2100 7659.tmp 100 PID 2100 wrote to memory of 2560 2100 7659.tmp 100 PID 2100 wrote to memory of 2560 2100 7659.tmp 100 PID 2560 wrote to memory of 3240 2560 76C6.tmp 101 PID 2560 wrote to memory of 3240 2560 76C6.tmp 101 PID 2560 wrote to memory of 3240 2560 76C6.tmp 101 PID 3240 wrote to memory of 4468 3240 7743.tmp 102 PID 3240 wrote to memory of 4468 3240 7743.tmp 102 PID 3240 wrote to memory of 4468 3240 7743.tmp 102 PID 4468 wrote to memory of 3044 4468 77C0.tmp 103 PID 4468 wrote to memory of 3044 4468 77C0.tmp 103 PID 4468 wrote to memory of 3044 4468 77C0.tmp 103 PID 3044 wrote to memory of 3040 3044 784D.tmp 104 PID 3044 wrote to memory of 3040 3044 784D.tmp 104 PID 3044 wrote to memory of 3040 3044 784D.tmp 104 PID 3040 wrote to memory of 2284 3040 7947.tmp 105 PID 3040 wrote to memory of 2284 3040 7947.tmp 105 PID 3040 wrote to memory of 2284 3040 7947.tmp 105 PID 2284 wrote to memory of 4364 2284 79A4.tmp 107 PID 2284 wrote to memory of 4364 2284 79A4.tmp 107 PID 2284 wrote to memory of 4364 2284 79A4.tmp 107 PID 4364 wrote to memory of 4748 4364 7B0C.tmp 108 PID 4364 wrote to memory of 4748 4364 7B0C.tmp 108 PID 4364 wrote to memory of 4748 4364 7B0C.tmp 108 PID 4748 wrote to memory of 4372 4748 7BE7.tmp 109 PID 4748 wrote to memory of 4372 4748 7BE7.tmp 109 PID 4748 wrote to memory of 4372 4748 7BE7.tmp 109 PID 4372 wrote to memory of 4784 4372 7C83.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"23⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"24⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"25⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"26⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"27⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"28⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"29⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"30⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"31⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"32⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"33⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"34⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"35⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"36⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"37⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"38⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"39⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"40⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"41⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"42⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"43⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"44⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"45⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"46⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"47⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"48⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"49⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"50⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"51⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"52⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"53⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"54⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"55⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"56⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"57⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"58⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"59⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"60⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"61⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"62⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"63⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"64⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"65⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"66⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"67⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"68⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"69⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"70⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"71⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"72⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"73⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"74⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"75⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"76⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"77⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"78⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"79⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"80⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"81⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"82⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"83⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"84⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"85⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"86⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"87⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"88⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"89⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"90⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"91⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"92⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"93⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"94⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"95⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"96⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"97⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"98⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"99⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"100⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"101⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"102⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"103⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"104⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"105⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"106⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"107⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"108⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"110⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"111⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"112⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"113⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"114⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"116⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"117⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"118⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"119⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"120⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"121⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"122⤵PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-