Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe
-
Size
541KB
-
MD5
273ed4fe0ddc32b03539399b6bc6a228
-
SHA1
f03ee092fc6ad8e8f82e159a17a072c8ad33182a
-
SHA256
6d32f6010ae7e4aebc05ec92378eacf10012979f965e95f92eda13b6b26638df
-
SHA512
1317872d798c24304c3bef9f87c2c442598534335e5fc0a0a11d39d47dd93f8058df2daa094f9afa54bc069a80527ce772ebc3bcee19122662492c09147e81c2
-
SSDEEP
12288:UU5rCOTeifRsyVgD60vrbggWTnmrZa73ctO:UUQOJfpgDX+TmrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4988 30B5.tmp 3664 3122.tmp 2928 318F.tmp 1196 31FD.tmp 932 325A.tmp 3992 32B8.tmp 4344 3316.tmp 3352 3383.tmp 3284 33D1.tmp 2172 342F.tmp 2244 348D.tmp 2092 34FA.tmp 4252 3548.tmp 4896 3597.tmp 3800 35E5.tmp 4672 3633.tmp 1636 3681.tmp 3504 36CF.tmp 4012 374C.tmp 4352 37AA.tmp 1460 37F8.tmp 4028 3875.tmp 5040 38E2.tmp 3952 3930.tmp 4248 397F.tmp 2908 39FC.tmp 5112 3A69.tmp 1032 3AD6.tmp 564 3B53.tmp 3344 3BB1.tmp 3524 3BFF.tmp 372 3C5D.tmp 1764 3CDA.tmp 3816 3D38.tmp 1804 3D95.tmp 996 3DE4.tmp 2520 3ECE.tmp 3744 3F2C.tmp 1920 3F7A.tmp 2924 3FC8.tmp 2108 4016.tmp 3168 4064.tmp 640 40C2.tmp 1196 4110.tmp 1924 415E.tmp 3300 41AC.tmp 2824 41FA.tmp 4344 4249.tmp 1492 42A6.tmp 1840 42F4.tmp 4536 4352.tmp 2484 43B0.tmp 3092 440E.tmp 2124 445C.tmp 3172 44BA.tmp 1048 4517.tmp 3944 4565.tmp 2040 45B4.tmp 4548 4602.tmp 2548 4650.tmp 1000 469E.tmp 1636 46FC.tmp 4544 474A.tmp 1456 4798.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1136 wrote to memory of 4988 1136 2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe 87 PID 1136 wrote to memory of 4988 1136 2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe 87 PID 1136 wrote to memory of 4988 1136 2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe 87 PID 4988 wrote to memory of 3664 4988 30B5.tmp 88 PID 4988 wrote to memory of 3664 4988 30B5.tmp 88 PID 4988 wrote to memory of 3664 4988 30B5.tmp 88 PID 3664 wrote to memory of 2928 3664 3122.tmp 90 PID 3664 wrote to memory of 2928 3664 3122.tmp 90 PID 3664 wrote to memory of 2928 3664 3122.tmp 90 PID 2928 wrote to memory of 1196 2928 318F.tmp 91 PID 2928 wrote to memory of 1196 2928 318F.tmp 91 PID 2928 wrote to memory of 1196 2928 318F.tmp 91 PID 1196 wrote to memory of 932 1196 31FD.tmp 92 PID 1196 wrote to memory of 932 1196 31FD.tmp 92 PID 1196 wrote to memory of 932 1196 31FD.tmp 92 PID 932 wrote to memory of 3992 932 325A.tmp 93 PID 932 wrote to memory of 3992 932 325A.tmp 93 PID 932 wrote to memory of 3992 932 325A.tmp 93 PID 3992 wrote to memory of 4344 3992 32B8.tmp 94 PID 3992 wrote to memory of 4344 3992 32B8.tmp 94 PID 3992 wrote to memory of 4344 3992 32B8.tmp 94 PID 4344 wrote to memory of 3352 4344 3316.tmp 95 PID 4344 wrote to memory of 3352 4344 3316.tmp 95 PID 4344 wrote to memory of 3352 4344 3316.tmp 95 PID 3352 wrote to memory of 3284 3352 3383.tmp 96 PID 3352 wrote to memory of 3284 3352 3383.tmp 96 PID 3352 wrote to memory of 3284 3352 3383.tmp 96 PID 3284 wrote to memory of 2172 3284 33D1.tmp 97 PID 3284 wrote to memory of 2172 3284 33D1.tmp 97 PID 3284 wrote to memory of 2172 3284 33D1.tmp 97 PID 2172 wrote to memory of 2244 2172 342F.tmp 99 PID 2172 wrote to memory of 2244 2172 342F.tmp 99 PID 2172 wrote to memory of 2244 2172 342F.tmp 99 PID 2244 wrote to memory of 2092 2244 348D.tmp 100 PID 2244 wrote to memory of 2092 2244 348D.tmp 100 PID 2244 wrote to memory of 2092 2244 348D.tmp 100 PID 2092 wrote to memory of 4252 2092 34FA.tmp 101 PID 2092 wrote to memory of 4252 2092 34FA.tmp 101 PID 2092 wrote to memory of 4252 2092 34FA.tmp 101 PID 4252 wrote to memory of 4896 4252 3548.tmp 102 PID 4252 wrote to memory of 4896 4252 3548.tmp 102 PID 4252 wrote to memory of 4896 4252 3548.tmp 102 PID 4896 wrote to memory of 3800 4896 3597.tmp 103 PID 4896 wrote to memory of 3800 4896 3597.tmp 103 PID 4896 wrote to memory of 3800 4896 3597.tmp 103 PID 3800 wrote to memory of 4672 3800 35E5.tmp 104 PID 3800 wrote to memory of 4672 3800 35E5.tmp 104 PID 3800 wrote to memory of 4672 3800 35E5.tmp 104 PID 4672 wrote to memory of 1636 4672 3633.tmp 105 PID 4672 wrote to memory of 1636 4672 3633.tmp 105 PID 4672 wrote to memory of 1636 4672 3633.tmp 105 PID 1636 wrote to memory of 3504 1636 3681.tmp 106 PID 1636 wrote to memory of 3504 1636 3681.tmp 106 PID 1636 wrote to memory of 3504 1636 3681.tmp 106 PID 3504 wrote to memory of 4012 3504 36CF.tmp 107 PID 3504 wrote to memory of 4012 3504 36CF.tmp 107 PID 3504 wrote to memory of 4012 3504 36CF.tmp 107 PID 4012 wrote to memory of 4352 4012 374C.tmp 108 PID 4012 wrote to memory of 4352 4012 374C.tmp 108 PID 4012 wrote to memory of 4352 4012 374C.tmp 108 PID 4352 wrote to memory of 1460 4352 37AA.tmp 109 PID 4352 wrote to memory of 1460 4352 37AA.tmp 109 PID 4352 wrote to memory of 1460 4352 37AA.tmp 109 PID 1460 wrote to memory of 4028 1460 37F8.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_273ed4fe0ddc32b03539399b6bc6a228_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\31FD.tmp"C:\Users\Admin\AppData\Local\Temp\31FD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\3316.tmp"C:\Users\Admin\AppData\Local\Temp\3316.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\33D1.tmp"C:\Users\Admin\AppData\Local\Temp\33D1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"23⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"24⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"25⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"26⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"27⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"28⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"29⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"30⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"31⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"32⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"33⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"34⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"35⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"36⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"37⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"38⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"39⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"40⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"41⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"42⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"43⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"44⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"45⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"46⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"47⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"48⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"49⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"50⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"51⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"52⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"53⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"54⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"55⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"56⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"57⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"58⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"59⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"60⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"61⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"62⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"63⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"64⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"65⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"66⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"67⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"68⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"69⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"70⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"71⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"72⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"73⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"74⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"76⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"77⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"78⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"79⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"80⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"81⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"82⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"83⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"84⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"85⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"86⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"87⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"88⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"89⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"90⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"91⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"93⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"94⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"95⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"96⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"97⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"98⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"99⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"100⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"101⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"102⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"103⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"104⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"105⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"106⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"107⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"108⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"109⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"110⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"111⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"112⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"113⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"114⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"115⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"116⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"117⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"118⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"119⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"120⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"121⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"122⤵PID:3204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-