Analysis
-
max time kernel
150s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe
-
Size
486KB
-
MD5
03613a4d2e0327dbb4f16c9ea08e9a5d
-
SHA1
6acb85ad3649039dba134f6e294ed1441fece0fb
-
SHA256
7ad19b3e9115d043922deef83c794ba2432bb5477d25b16bd2bbc8c74e48bf4b
-
SHA512
d9717fa757a9e5c08ec146a0ae41a7bff90ba1d1d1fb54b33e46b0b87c6e1a596d8c3f0f2210074e72da0e334458ea5d878c8ce756b7239295cb7fac9945f110
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7bT6+nD3qDeX90CnFALSQbkfy1DVCOCbRbg/0:UU5rCOTeiD36ceeDF8bKkDY1RbeyNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1660 2EA1.tmp 2784 2F0F.tmp 2328 2F9B.tmp 5048 3009.tmp 920 3076.tmp 2716 30F3.tmp 536 3170.tmp 3964 31CE.tmp 1800 324B.tmp 2140 32A9.tmp 1712 3306.tmp 4196 3354.tmp 3440 33B2.tmp 1048 3400.tmp 4752 344E.tmp 4536 34CB.tmp 3296 3539.tmp 4512 3587.tmp 684 3604.tmp 5056 3652.tmp 3388 36A0.tmp 5084 36FE.tmp 2992 376B.tmp 4516 37E8.tmp 4200 3846.tmp 4276 38B3.tmp 2428 3930.tmp 4476 397F.tmp 1608 39EC.tmp 4848 3A4A.tmp 2332 3AA7.tmp 4428 3B15.tmp 2440 3B92.tmp 4588 3BF0.tmp 2852 3C3E.tmp 1596 3C8C.tmp 4960 3CDA.tmp 1336 3D28.tmp 2580 3D76.tmp 2624 3DC4.tmp 4552 3E12.tmp 3764 3E70.tmp 3644 3ECE.tmp 2104 3F2C.tmp 3284 3F89.tmp 4344 3FD8.tmp 4920 4026.tmp 4988 4083.tmp 3844 40E1.tmp 3484 412F.tmp 4992 417D.tmp 1372 41CC.tmp 440 4229.tmp 2336 4277.tmp 1364 42D5.tmp 4880 4333.tmp 644 4381.tmp 2000 43CF.tmp 3112 441D.tmp 4996 446B.tmp 4976 44C9.tmp 3792 4527.tmp 1760 4575.tmp 2152 45C3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 1660 3164 2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe 85 PID 3164 wrote to memory of 1660 3164 2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe 85 PID 3164 wrote to memory of 1660 3164 2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe 85 PID 1660 wrote to memory of 2784 1660 2EA1.tmp 86 PID 1660 wrote to memory of 2784 1660 2EA1.tmp 86 PID 1660 wrote to memory of 2784 1660 2EA1.tmp 86 PID 2784 wrote to memory of 2328 2784 2F0F.tmp 88 PID 2784 wrote to memory of 2328 2784 2F0F.tmp 88 PID 2784 wrote to memory of 2328 2784 2F0F.tmp 88 PID 2328 wrote to memory of 5048 2328 2F9B.tmp 90 PID 2328 wrote to memory of 5048 2328 2F9B.tmp 90 PID 2328 wrote to memory of 5048 2328 2F9B.tmp 90 PID 5048 wrote to memory of 920 5048 3009.tmp 91 PID 5048 wrote to memory of 920 5048 3009.tmp 91 PID 5048 wrote to memory of 920 5048 3009.tmp 91 PID 920 wrote to memory of 2716 920 3076.tmp 93 PID 920 wrote to memory of 2716 920 3076.tmp 93 PID 920 wrote to memory of 2716 920 3076.tmp 93 PID 2716 wrote to memory of 536 2716 30F3.tmp 94 PID 2716 wrote to memory of 536 2716 30F3.tmp 94 PID 2716 wrote to memory of 536 2716 30F3.tmp 94 PID 536 wrote to memory of 3964 536 3170.tmp 95 PID 536 wrote to memory of 3964 536 3170.tmp 95 PID 536 wrote to memory of 3964 536 3170.tmp 95 PID 3964 wrote to memory of 1800 3964 31CE.tmp 96 PID 3964 wrote to memory of 1800 3964 31CE.tmp 96 PID 3964 wrote to memory of 1800 3964 31CE.tmp 96 PID 1800 wrote to memory of 2140 1800 324B.tmp 97 PID 1800 wrote to memory of 2140 1800 324B.tmp 97 PID 1800 wrote to memory of 2140 1800 324B.tmp 97 PID 2140 wrote to memory of 1712 2140 32A9.tmp 98 PID 2140 wrote to memory of 1712 2140 32A9.tmp 98 PID 2140 wrote to memory of 1712 2140 32A9.tmp 98 PID 1712 wrote to memory of 4196 1712 3306.tmp 99 PID 1712 wrote to memory of 4196 1712 3306.tmp 99 PID 1712 wrote to memory of 4196 1712 3306.tmp 99 PID 4196 wrote to memory of 3440 4196 3354.tmp 100 PID 4196 wrote to memory of 3440 4196 3354.tmp 100 PID 4196 wrote to memory of 3440 4196 3354.tmp 100 PID 3440 wrote to memory of 1048 3440 33B2.tmp 101 PID 3440 wrote to memory of 1048 3440 33B2.tmp 101 PID 3440 wrote to memory of 1048 3440 33B2.tmp 101 PID 1048 wrote to memory of 4752 1048 3400.tmp 102 PID 1048 wrote to memory of 4752 1048 3400.tmp 102 PID 1048 wrote to memory of 4752 1048 3400.tmp 102 PID 4752 wrote to memory of 4536 4752 344E.tmp 103 PID 4752 wrote to memory of 4536 4752 344E.tmp 103 PID 4752 wrote to memory of 4536 4752 344E.tmp 103 PID 4536 wrote to memory of 3296 4536 34CB.tmp 104 PID 4536 wrote to memory of 3296 4536 34CB.tmp 104 PID 4536 wrote to memory of 3296 4536 34CB.tmp 104 PID 3296 wrote to memory of 4512 3296 3539.tmp 105 PID 3296 wrote to memory of 4512 3296 3539.tmp 105 PID 3296 wrote to memory of 4512 3296 3539.tmp 105 PID 4512 wrote to memory of 684 4512 3587.tmp 106 PID 4512 wrote to memory of 684 4512 3587.tmp 106 PID 4512 wrote to memory of 684 4512 3587.tmp 106 PID 684 wrote to memory of 5056 684 3604.tmp 107 PID 684 wrote to memory of 5056 684 3604.tmp 107 PID 684 wrote to memory of 5056 684 3604.tmp 107 PID 5056 wrote to memory of 3388 5056 3652.tmp 108 PID 5056 wrote to memory of 3388 5056 3652.tmp 108 PID 5056 wrote to memory of 3388 5056 3652.tmp 108 PID 3388 wrote to memory of 5084 3388 36A0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_03613a4d2e0327dbb4f16c9ea08e9a5d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\2EA1.tmp"C:\Users\Admin\AppData\Local\Temp\2EA1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3009.tmp"C:\Users\Admin\AppData\Local\Temp\3009.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\30F3.tmp"C:\Users\Admin\AppData\Local\Temp\30F3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\31CE.tmp"C:\Users\Admin\AppData\Local\Temp\31CE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\3400.tmp"C:\Users\Admin\AppData\Local\Temp\3400.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"23⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"24⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"25⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"26⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"27⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"28⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"29⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"30⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"31⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"32⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"33⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"34⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"35⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"36⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"37⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"38⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"39⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"40⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"41⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"42⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"43⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"44⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"45⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"46⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"47⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"48⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"49⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"50⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"51⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"52⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"53⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"54⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"55⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"56⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"57⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"58⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"59⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"60⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"61⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"62⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"63⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"64⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"65⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"66⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"67⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"68⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"69⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"70⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"71⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"72⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"73⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"74⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"75⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"76⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"77⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"78⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"79⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"80⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"81⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"82⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"83⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"84⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"85⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"86⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"87⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"88⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"89⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"90⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"91⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"93⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"94⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"95⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"97⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"98⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"99⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"100⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"101⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"102⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"103⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"104⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"105⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"106⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"107⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"108⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"109⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"110⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"111⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"112⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"113⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"114⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"115⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"116⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"117⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"118⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"119⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"120⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"121⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-