Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe
-
Size
541KB
-
MD5
a43875bd7ed1e7d12e99b72f45e869c8
-
SHA1
6b691c44ab4a43746fe88734b310edc6cb71bb29
-
SHA256
fdf92ad6841b2f8f367b5b38ffdbda84e039cb7b155d16e9ec2da39b96f3ec19
-
SHA512
bec14228c4b183dcbea3d370722180f828a2db5b7c78bf06ecc42f1d895f8c73f0e8da101e7d391166d4dd2802af4575c7a97b0686e12c262e9510442f80cbed
-
SSDEEP
12288:UU5rCOTeiflYpR+XP8TWF4z8iCsrZa73ctO:UUQOJfWpRy8TCbifrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1688 24DD.tmp 4088 254B.tmp 4584 25D7.tmp 2292 2645.tmp 8 26B2.tmp 1136 2710.tmp 3096 276E.tmp 3016 27DB.tmp 2744 2848.tmp 2132 2896.tmp 756 2904.tmp 3376 2971.tmp 2336 29CF.tmp 4748 2A2D.tmp 4532 2A8A.tmp 4204 2AF8.tmp 4440 2B46.tmp 4820 2BA4.tmp 4124 2C21.tmp 3352 2C7E.tmp 2624 2CEC.tmp 4672 2D69.tmp 1940 2DD6.tmp 1264 2E24.tmp 5072 2E92.tmp 2272 2F0F.tmp 4512 2F9B.tmp 3056 2FF9.tmp 4348 3076.tmp 3960 30E3.tmp 4388 3132.tmp 1692 319F.tmp 4052 31FD.tmp 2952 325A.tmp 988 3335.tmp 1300 3393.tmp 3624 33E1.tmp 452 343F.tmp 2476 349D.tmp 2404 34EB.tmp 1148 3548.tmp 3976 35A6.tmp 1136 3604.tmp 4180 3662.tmp 2716 36BF.tmp 3264 370E.tmp 4636 376B.tmp 2188 37C9.tmp 3760 3827.tmp 4612 3885.tmp 4748 38E2.tmp 4020 3930.tmp 540 397F.tmp 4724 39EC.tmp 372 3A3A.tmp 4124 3A88.tmp 2028 3AE6.tmp 3864 3B44.tmp 1288 3BA1.tmp 4672 3BFF.tmp 1808 3C5D.tmp 1396 3CBB.tmp 1408 3D18.tmp 956 3D76.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3500 wrote to memory of 1688 3500 2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe 82 PID 3500 wrote to memory of 1688 3500 2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe 82 PID 3500 wrote to memory of 1688 3500 2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe 82 PID 1688 wrote to memory of 4088 1688 24DD.tmp 83 PID 1688 wrote to memory of 4088 1688 24DD.tmp 83 PID 1688 wrote to memory of 4088 1688 24DD.tmp 83 PID 4088 wrote to memory of 4584 4088 254B.tmp 84 PID 4088 wrote to memory of 4584 4088 254B.tmp 84 PID 4088 wrote to memory of 4584 4088 254B.tmp 84 PID 4584 wrote to memory of 2292 4584 25D7.tmp 85 PID 4584 wrote to memory of 2292 4584 25D7.tmp 85 PID 4584 wrote to memory of 2292 4584 25D7.tmp 85 PID 2292 wrote to memory of 8 2292 2645.tmp 87 PID 2292 wrote to memory of 8 2292 2645.tmp 87 PID 2292 wrote to memory of 8 2292 2645.tmp 87 PID 8 wrote to memory of 1136 8 26B2.tmp 88 PID 8 wrote to memory of 1136 8 26B2.tmp 88 PID 8 wrote to memory of 1136 8 26B2.tmp 88 PID 1136 wrote to memory of 3096 1136 2710.tmp 89 PID 1136 wrote to memory of 3096 1136 2710.tmp 89 PID 1136 wrote to memory of 3096 1136 2710.tmp 89 PID 3096 wrote to memory of 3016 3096 276E.tmp 91 PID 3096 wrote to memory of 3016 3096 276E.tmp 91 PID 3096 wrote to memory of 3016 3096 276E.tmp 91 PID 3016 wrote to memory of 2744 3016 27DB.tmp 92 PID 3016 wrote to memory of 2744 3016 27DB.tmp 92 PID 3016 wrote to memory of 2744 3016 27DB.tmp 92 PID 2744 wrote to memory of 2132 2744 2848.tmp 93 PID 2744 wrote to memory of 2132 2744 2848.tmp 93 PID 2744 wrote to memory of 2132 2744 2848.tmp 93 PID 2132 wrote to memory of 756 2132 2896.tmp 95 PID 2132 wrote to memory of 756 2132 2896.tmp 95 PID 2132 wrote to memory of 756 2132 2896.tmp 95 PID 756 wrote to memory of 3376 756 2904.tmp 96 PID 756 wrote to memory of 3376 756 2904.tmp 96 PID 756 wrote to memory of 3376 756 2904.tmp 96 PID 3376 wrote to memory of 2336 3376 2971.tmp 97 PID 3376 wrote to memory of 2336 3376 2971.tmp 97 PID 3376 wrote to memory of 2336 3376 2971.tmp 97 PID 2336 wrote to memory of 4748 2336 29CF.tmp 98 PID 2336 wrote to memory of 4748 2336 29CF.tmp 98 PID 2336 wrote to memory of 4748 2336 29CF.tmp 98 PID 4748 wrote to memory of 4532 4748 2A2D.tmp 99 PID 4748 wrote to memory of 4532 4748 2A2D.tmp 99 PID 4748 wrote to memory of 4532 4748 2A2D.tmp 99 PID 4532 wrote to memory of 4204 4532 2A8A.tmp 100 PID 4532 wrote to memory of 4204 4532 2A8A.tmp 100 PID 4532 wrote to memory of 4204 4532 2A8A.tmp 100 PID 4204 wrote to memory of 4440 4204 2AF8.tmp 101 PID 4204 wrote to memory of 4440 4204 2AF8.tmp 101 PID 4204 wrote to memory of 4440 4204 2AF8.tmp 101 PID 4440 wrote to memory of 4820 4440 2B46.tmp 102 PID 4440 wrote to memory of 4820 4440 2B46.tmp 102 PID 4440 wrote to memory of 4820 4440 2B46.tmp 102 PID 4820 wrote to memory of 4124 4820 2BA4.tmp 103 PID 4820 wrote to memory of 4124 4820 2BA4.tmp 103 PID 4820 wrote to memory of 4124 4820 2BA4.tmp 103 PID 4124 wrote to memory of 3352 4124 2C21.tmp 104 PID 4124 wrote to memory of 3352 4124 2C21.tmp 104 PID 4124 wrote to memory of 3352 4124 2C21.tmp 104 PID 3352 wrote to memory of 2624 3352 2C7E.tmp 105 PID 3352 wrote to memory of 2624 3352 2C7E.tmp 105 PID 3352 wrote to memory of 2624 3352 2C7E.tmp 105 PID 2624 wrote to memory of 4672 2624 2CEC.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_a43875bd7ed1e7d12e99b72f45e869c8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\24DD.tmp"C:\Users\Admin\AppData\Local\Temp\24DD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\254B.tmp"C:\Users\Admin\AppData\Local\Temp\254B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\25D7.tmp"C:\Users\Admin\AppData\Local\Temp\25D7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2645.tmp"C:\Users\Admin\AppData\Local\Temp\2645.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\26B2.tmp"C:\Users\Admin\AppData\Local\Temp\26B2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\29CF.tmp"C:\Users\Admin\AppData\Local\Temp\29CF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\2A2D.tmp"C:\Users\Admin\AppData\Local\Temp\2A2D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\2B46.tmp"C:\Users\Admin\AppData\Local\Temp\2B46.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2BA4.tmp"C:\Users\Admin\AppData\Local\Temp\2BA4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2C21.tmp"C:\Users\Admin\AppData\Local\Temp\2C21.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2C7E.tmp"C:\Users\Admin\AppData\Local\Temp\2C7E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2CEC.tmp"C:\Users\Admin\AppData\Local\Temp\2CEC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2D69.tmp"C:\Users\Admin\AppData\Local\Temp\2D69.tmp"23⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\2DD6.tmp"C:\Users\Admin\AppData\Local\Temp\2DD6.tmp"24⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\2E24.tmp"C:\Users\Admin\AppData\Local\Temp\2E24.tmp"25⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2E92.tmp"C:\Users\Admin\AppData\Local\Temp\2E92.tmp"26⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"C:\Users\Admin\AppData\Local\Temp\2F0F.tmp"27⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"29⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3076.tmp"C:\Users\Admin\AppData\Local\Temp\3076.tmp"30⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\30E3.tmp"C:\Users\Admin\AppData\Local\Temp\30E3.tmp"31⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3132.tmp"C:\Users\Admin\AppData\Local\Temp\3132.tmp"32⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"33⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\31FD.tmp"C:\Users\Admin\AppData\Local\Temp\31FD.tmp"34⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\325A.tmp"C:\Users\Admin\AppData\Local\Temp\325A.tmp"35⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"36⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\3335.tmp"C:\Users\Admin\AppData\Local\Temp\3335.tmp"37⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"38⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"39⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"40⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"41⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\34EB.tmp"C:\Users\Admin\AppData\Local\Temp\34EB.tmp"42⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"43⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"44⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"45⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"46⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"47⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"48⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\376B.tmp"C:\Users\Admin\AppData\Local\Temp\376B.tmp"49⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"50⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"51⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\3885.tmp"C:\Users\Admin\AppData\Local\Temp\3885.tmp"52⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"53⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"54⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"55⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"56⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"57⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\3A88.tmp"C:\Users\Admin\AppData\Local\Temp\3A88.tmp"58⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"59⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"60⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"61⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"62⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"63⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"64⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"65⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"66⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"67⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"68⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"69⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"70⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"71⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"72⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"73⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"74⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"75⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"76⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"77⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"78⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"79⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"80⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"81⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"82⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"83⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"84⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"85⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"86⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"87⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"88⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"89⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"90⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"91⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"92⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"93⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"94⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"95⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"96⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"97⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"98⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"99⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"100⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"101⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"102⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"103⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"104⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"105⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"106⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"107⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"108⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"109⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"110⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"111⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"112⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"113⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"114⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"115⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"116⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"117⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"118⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"119⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"120⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"121⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"122⤵PID:4328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-