Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe
-
Size
487KB
-
MD5
8f35e1bb33f945b39fc701a74557a668
-
SHA1
383da54c51fddde0307eac48d67b5c3b299e8422
-
SHA256
45d477c830dc6259e4e5d6018dd4d5d75d3bc78cfd4ab61e2d1bd5e4a07708d6
-
SHA512
c74f7e87d81ad336593bc859c0d998451fda9c6987bb48752b8e3aa676d007549b87dd88f24c4756aba66b4ec0bcee443cdd98b02b62969c7dc2e673258cac11
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxEzRrmZ2pZRXJR1Ax3QD8Ji7Z7Uez/h7ANXPw:yU5rCOTeiNqzc2h5R1uctd58ZORpbZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4988 3F5B.tmp 536 3FB8.tmp 228 4016.tmp 3596 4093.tmp 1676 40F1.tmp 2852 414F.tmp 800 419D.tmp 4720 41EB.tmp 3416 4239.tmp 552 4287.tmp 3760 42D5.tmp 1784 4323.tmp 2824 4381.tmp 1172 43CF.tmp 1332 442D.tmp 3312 447B.tmp 4360 44C9.tmp 4868 4517.tmp 3460 4575.tmp 3644 45D3.tmp 1912 4631.tmp 2652 46AE.tmp 1516 46FC.tmp 3216 474A.tmp 1324 4798.tmp 1580 47E6.tmp 2168 4853.tmp 4696 48A2.tmp 5080 48F0.tmp 2356 494D.tmp 3024 499C.tmp 4032 49EA.tmp 1732 4A47.tmp 3088 4AC4.tmp 4348 4B51.tmp 1684 4BDE.tmp 2700 4C4B.tmp 740 4CC8.tmp 4996 4D16.tmp 3740 4D74.tmp 2628 4DC2.tmp 1468 4E20.tmp 4276 4E6E.tmp 3200 4ECC.tmp 3616 4F1A.tmp 4984 4F78.tmp 2892 4FD5.tmp 4992 5023.tmp 4224 5072.tmp 4296 50C0.tmp 3712 510E.tmp 1644 515C.tmp 932 51AA.tmp 2244 51F8.tmp 5088 5246.tmp 4128 5294.tmp 4432 52E3.tmp 3136 5340.tmp 3320 538E.tmp 4724 53DD.tmp 3700 542B.tmp 2400 5488.tmp 4540 54D7.tmp 4824 5534.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4988 5104 2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe 84 PID 5104 wrote to memory of 4988 5104 2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe 84 PID 5104 wrote to memory of 4988 5104 2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe 84 PID 4988 wrote to memory of 536 4988 3F5B.tmp 85 PID 4988 wrote to memory of 536 4988 3F5B.tmp 85 PID 4988 wrote to memory of 536 4988 3F5B.tmp 85 PID 536 wrote to memory of 228 536 3FB8.tmp 86 PID 536 wrote to memory of 228 536 3FB8.tmp 86 PID 536 wrote to memory of 228 536 3FB8.tmp 86 PID 228 wrote to memory of 3596 228 4016.tmp 87 PID 228 wrote to memory of 3596 228 4016.tmp 87 PID 228 wrote to memory of 3596 228 4016.tmp 87 PID 3596 wrote to memory of 1676 3596 4093.tmp 88 PID 3596 wrote to memory of 1676 3596 4093.tmp 88 PID 3596 wrote to memory of 1676 3596 4093.tmp 88 PID 1676 wrote to memory of 2852 1676 40F1.tmp 89 PID 1676 wrote to memory of 2852 1676 40F1.tmp 89 PID 1676 wrote to memory of 2852 1676 40F1.tmp 89 PID 2852 wrote to memory of 800 2852 414F.tmp 90 PID 2852 wrote to memory of 800 2852 414F.tmp 90 PID 2852 wrote to memory of 800 2852 414F.tmp 90 PID 800 wrote to memory of 4720 800 419D.tmp 91 PID 800 wrote to memory of 4720 800 419D.tmp 91 PID 800 wrote to memory of 4720 800 419D.tmp 91 PID 4720 wrote to memory of 3416 4720 41EB.tmp 92 PID 4720 wrote to memory of 3416 4720 41EB.tmp 92 PID 4720 wrote to memory of 3416 4720 41EB.tmp 92 PID 3416 wrote to memory of 552 3416 4239.tmp 93 PID 3416 wrote to memory of 552 3416 4239.tmp 93 PID 3416 wrote to memory of 552 3416 4239.tmp 93 PID 552 wrote to memory of 3760 552 4287.tmp 94 PID 552 wrote to memory of 3760 552 4287.tmp 94 PID 552 wrote to memory of 3760 552 4287.tmp 94 PID 3760 wrote to memory of 1784 3760 42D5.tmp 95 PID 3760 wrote to memory of 1784 3760 42D5.tmp 95 PID 3760 wrote to memory of 1784 3760 42D5.tmp 95 PID 1784 wrote to memory of 2824 1784 4323.tmp 96 PID 1784 wrote to memory of 2824 1784 4323.tmp 96 PID 1784 wrote to memory of 2824 1784 4323.tmp 96 PID 2824 wrote to memory of 1172 2824 4381.tmp 97 PID 2824 wrote to memory of 1172 2824 4381.tmp 97 PID 2824 wrote to memory of 1172 2824 4381.tmp 97 PID 1172 wrote to memory of 1332 1172 43CF.tmp 98 PID 1172 wrote to memory of 1332 1172 43CF.tmp 98 PID 1172 wrote to memory of 1332 1172 43CF.tmp 98 PID 1332 wrote to memory of 3312 1332 442D.tmp 99 PID 1332 wrote to memory of 3312 1332 442D.tmp 99 PID 1332 wrote to memory of 3312 1332 442D.tmp 99 PID 3312 wrote to memory of 4360 3312 447B.tmp 100 PID 3312 wrote to memory of 4360 3312 447B.tmp 100 PID 3312 wrote to memory of 4360 3312 447B.tmp 100 PID 4360 wrote to memory of 4868 4360 44C9.tmp 101 PID 4360 wrote to memory of 4868 4360 44C9.tmp 101 PID 4360 wrote to memory of 4868 4360 44C9.tmp 101 PID 4868 wrote to memory of 3460 4868 4517.tmp 102 PID 4868 wrote to memory of 3460 4868 4517.tmp 102 PID 4868 wrote to memory of 3460 4868 4517.tmp 102 PID 3460 wrote to memory of 3644 3460 4575.tmp 103 PID 3460 wrote to memory of 3644 3460 4575.tmp 103 PID 3460 wrote to memory of 3644 3460 4575.tmp 103 PID 3644 wrote to memory of 1912 3644 45D3.tmp 104 PID 3644 wrote to memory of 1912 3644 45D3.tmp 104 PID 3644 wrote to memory of 1912 3644 45D3.tmp 104 PID 1912 wrote to memory of 2652 1912 4631.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_8f35e1bb33f945b39fc701a74557a668_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"23⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"24⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"25⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"26⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"27⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"28⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"29⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"30⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"31⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"32⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"33⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"34⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"35⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"36⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"37⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"38⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"39⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"40⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"41⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"42⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"43⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"44⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"45⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"46⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"47⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"48⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"49⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"50⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"51⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"52⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"53⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"54⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"55⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"56⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"57⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"58⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"59⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"60⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"61⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"62⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"63⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"64⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"65⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"66⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"67⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"68⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"69⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"70⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"71⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"72⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"73⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"74⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"75⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"76⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"77⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"78⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"79⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"80⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"81⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"82⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"83⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"84⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"85⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"86⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"87⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"88⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"89⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"90⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"91⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"92⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"93⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"94⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"95⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"96⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"97⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"98⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"99⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"100⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"101⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"102⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"103⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"104⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"105⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"106⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"107⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"108⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"109⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"110⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"111⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"112⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"113⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"114⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"115⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"116⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"117⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"118⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"120⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"121⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"122⤵PID:3824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-