Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 07:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe
-
Size
487KB
-
MD5
51f17356baad53fffaa8a0a896ad348a
-
SHA1
a16f7eb541ad246e17c2ce5a03ac3e00adcd6d63
-
SHA256
398635627602fd5db31a0494125d8cada3d50f099c48ef2504fcd76430429c0d
-
SHA512
87767d9554a4dfbb14288beec9628b325db0c25da8e98be46dbe6c92be4f16fa4ea99c06b67ad0618cd006ec77e1709a7b129d074dee48097bcb80a96f5d741a
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUOPVEvhrGey+83WOZj38kbwBnfe7nvM8ikhFU:HU5rCOTeiJTPwrM3BMc08PKNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2656 4297.tmp 2480 4323.tmp 4912 4391.tmp 3136 440E.tmp 1020 445C.tmp 3716 44C9.tmp 1976 4546.tmp 2788 4594.tmp 4304 45E2.tmp 864 465F.tmp 2260 46BD.tmp 5088 473A.tmp 32 4788.tmp 3000 47D6.tmp 3028 4825.tmp 3988 4873.tmp 4524 48D0.tmp 4008 491F.tmp 2020 499C.tmp 2164 49F9.tmp 4084 4A67.tmp 3664 4AE4.tmp 4640 4B32.tmp 532 4B90.tmp 1472 4BFD.tmp 3176 4C7A.tmp 3532 4CE7.tmp 2120 4D55.tmp 1376 4DC2.tmp 3904 4E10.tmp 936 4E7E.tmp 2488 4EDB.tmp 3164 4F49.tmp 60 4F97.tmp 2272 4FF5.tmp 724 5052.tmp 1392 50A0.tmp 2364 510E.tmp 3560 516C.tmp 4476 51BA.tmp 4292 5208.tmp 3488 5266.tmp 2324 52C3.tmp 3540 5321.tmp 1260 537F.tmp 3976 53CD.tmp 3640 541B.tmp 4856 5469.tmp 1964 54C7.tmp 4552 5515.tmp 4720 5573.tmp 3220 55C1.tmp 868 560F.tmp 2424 565D.tmp 1952 56BB.tmp 1744 5719.tmp 1576 5767.tmp 4440 57B5.tmp 4424 5803.tmp 1036 5851.tmp 1816 589F.tmp 3536 58FD.tmp 3544 594B.tmp 3432 59A9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1036 wrote to memory of 2656 1036 2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe 84 PID 1036 wrote to memory of 2656 1036 2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe 84 PID 1036 wrote to memory of 2656 1036 2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe 84 PID 2656 wrote to memory of 2480 2656 4297.tmp 85 PID 2656 wrote to memory of 2480 2656 4297.tmp 85 PID 2656 wrote to memory of 2480 2656 4297.tmp 85 PID 2480 wrote to memory of 4912 2480 4323.tmp 86 PID 2480 wrote to memory of 4912 2480 4323.tmp 86 PID 2480 wrote to memory of 4912 2480 4323.tmp 86 PID 4912 wrote to memory of 3136 4912 4391.tmp 87 PID 4912 wrote to memory of 3136 4912 4391.tmp 87 PID 4912 wrote to memory of 3136 4912 4391.tmp 87 PID 3136 wrote to memory of 1020 3136 440E.tmp 88 PID 3136 wrote to memory of 1020 3136 440E.tmp 88 PID 3136 wrote to memory of 1020 3136 440E.tmp 88 PID 1020 wrote to memory of 3716 1020 445C.tmp 89 PID 1020 wrote to memory of 3716 1020 445C.tmp 89 PID 1020 wrote to memory of 3716 1020 445C.tmp 89 PID 3716 wrote to memory of 1976 3716 44C9.tmp 90 PID 3716 wrote to memory of 1976 3716 44C9.tmp 90 PID 3716 wrote to memory of 1976 3716 44C9.tmp 90 PID 1976 wrote to memory of 2788 1976 4546.tmp 91 PID 1976 wrote to memory of 2788 1976 4546.tmp 91 PID 1976 wrote to memory of 2788 1976 4546.tmp 91 PID 2788 wrote to memory of 4304 2788 4594.tmp 92 PID 2788 wrote to memory of 4304 2788 4594.tmp 92 PID 2788 wrote to memory of 4304 2788 4594.tmp 92 PID 4304 wrote to memory of 864 4304 45E2.tmp 93 PID 4304 wrote to memory of 864 4304 45E2.tmp 93 PID 4304 wrote to memory of 864 4304 45E2.tmp 93 PID 864 wrote to memory of 2260 864 465F.tmp 94 PID 864 wrote to memory of 2260 864 465F.tmp 94 PID 864 wrote to memory of 2260 864 465F.tmp 94 PID 2260 wrote to memory of 5088 2260 46BD.tmp 95 PID 2260 wrote to memory of 5088 2260 46BD.tmp 95 PID 2260 wrote to memory of 5088 2260 46BD.tmp 95 PID 5088 wrote to memory of 32 5088 473A.tmp 96 PID 5088 wrote to memory of 32 5088 473A.tmp 96 PID 5088 wrote to memory of 32 5088 473A.tmp 96 PID 32 wrote to memory of 3000 32 4788.tmp 97 PID 32 wrote to memory of 3000 32 4788.tmp 97 PID 32 wrote to memory of 3000 32 4788.tmp 97 PID 3000 wrote to memory of 3028 3000 47D6.tmp 98 PID 3000 wrote to memory of 3028 3000 47D6.tmp 98 PID 3000 wrote to memory of 3028 3000 47D6.tmp 98 PID 3028 wrote to memory of 3988 3028 4825.tmp 99 PID 3028 wrote to memory of 3988 3028 4825.tmp 99 PID 3028 wrote to memory of 3988 3028 4825.tmp 99 PID 3988 wrote to memory of 4524 3988 4873.tmp 100 PID 3988 wrote to memory of 4524 3988 4873.tmp 100 PID 3988 wrote to memory of 4524 3988 4873.tmp 100 PID 4524 wrote to memory of 4008 4524 48D0.tmp 101 PID 4524 wrote to memory of 4008 4524 48D0.tmp 101 PID 4524 wrote to memory of 4008 4524 48D0.tmp 101 PID 4008 wrote to memory of 2020 4008 491F.tmp 102 PID 4008 wrote to memory of 2020 4008 491F.tmp 102 PID 4008 wrote to memory of 2020 4008 491F.tmp 102 PID 2020 wrote to memory of 2164 2020 499C.tmp 103 PID 2020 wrote to memory of 2164 2020 499C.tmp 103 PID 2020 wrote to memory of 2164 2020 499C.tmp 103 PID 2164 wrote to memory of 4084 2164 49F9.tmp 104 PID 2164 wrote to memory of 4084 2164 49F9.tmp 104 PID 2164 wrote to memory of 4084 2164 49F9.tmp 104 PID 4084 wrote to memory of 3664 4084 4A67.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_51f17356baad53fffaa8a0a896ad348a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"23⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"24⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"25⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"26⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"27⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"28⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"29⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"30⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"31⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"32⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"33⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"34⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"35⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"36⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"37⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"38⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"39⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"40⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"41⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"42⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"43⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"44⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"45⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"46⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"47⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"48⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"49⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"50⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"51⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"52⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"53⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"54⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"55⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"56⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"57⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"58⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"59⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"60⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"61⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"62⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"63⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"64⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"65⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"66⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"67⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"68⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"70⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"71⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"72⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"73⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"74⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"76⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"77⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"79⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"80⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"81⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"82⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"83⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"84⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"85⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"86⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"87⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"88⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"89⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"90⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"91⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"92⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"93⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"94⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"95⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"96⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"97⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"98⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"99⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"100⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"101⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"103⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"104⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"105⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"106⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"107⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"108⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"109⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"110⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"111⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"112⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"114⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"115⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"116⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"117⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"118⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"119⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"120⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"121⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"122⤵PID:4456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-