Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe
-
Size
486KB
-
MD5
8780488424f30ee48fc3ba8bc86d253d
-
SHA1
405b9523a7c1e6ff0e14b21302be9f867bb14c8e
-
SHA256
3683310093c18f58ab101d403778c1cbd3f95f25b15dfabe81b3ff83363522ba
-
SHA512
700d3daa03cd5c1e35a40088419b9d01dfc5e5566570f7428071eb030b07319064cf49a830a4634ce287a3ed2d4aa9ad77d863a5a3004854e0220c4dfc1f1253
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7DZGvM9reTne1A9jpnss+wSmAUueM50EJBvCa:/U5rCOTeiDD7ret9JsshAUueMBHzNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4452 3577.tmp 3944 35D5.tmp 2136 3633.tmp 1856 3691.tmp 3536 36EE.tmp 5060 374C.tmp 4444 379A.tmp 1760 3808.tmp 456 3865.tmp 1320 38C3.tmp 3836 3930.tmp 3964 397F.tmp 4608 39CD.tmp 4620 3A3A.tmp 3780 3A98.tmp 3256 3B15.tmp 748 3B63.tmp 1600 3BD0.tmp 4336 3C2E.tmp 8 3C7C.tmp 3104 3CF9.tmp 4540 3D57.tmp 1956 3DC4.tmp 2272 3E12.tmp 3700 3E70.tmp 3152 3EDE.tmp 1216 3F3B.tmp 2972 3F89.tmp 1964 3FD8.tmp 5088 4026.tmp 2020 4083.tmp 972 40F1.tmp 1360 414F.tmp 4996 41AC.tmp 528 420A.tmp 4876 4258.tmp 4416 42C6.tmp 4432 4314.tmp 2036 4371.tmp 1672 43C0.tmp 3044 440E.tmp 3824 445C.tmp 840 44AA.tmp 1632 4508.tmp 3348 4556.tmp 4988 45B4.tmp 1760 4611.tmp 5056 466F.tmp 2708 46CD.tmp 2780 472B.tmp 3016 4779.tmp 540 47E6.tmp 3408 4834.tmp 2268 4892.tmp 3080 48F0.tmp 4516 494D.tmp 2960 499C.tmp 4428 49F9.tmp 4936 4A47.tmp 2624 4A96.tmp 2876 4AE4.tmp 4128 4B32.tmp 2524 4B90.tmp 1188 4BED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 4452 2468 2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe 83 PID 2468 wrote to memory of 4452 2468 2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe 83 PID 2468 wrote to memory of 4452 2468 2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe 83 PID 4452 wrote to memory of 3944 4452 3577.tmp 84 PID 4452 wrote to memory of 3944 4452 3577.tmp 84 PID 4452 wrote to memory of 3944 4452 3577.tmp 84 PID 3944 wrote to memory of 2136 3944 35D5.tmp 85 PID 3944 wrote to memory of 2136 3944 35D5.tmp 85 PID 3944 wrote to memory of 2136 3944 35D5.tmp 85 PID 2136 wrote to memory of 1856 2136 3633.tmp 86 PID 2136 wrote to memory of 1856 2136 3633.tmp 86 PID 2136 wrote to memory of 1856 2136 3633.tmp 86 PID 1856 wrote to memory of 3536 1856 3691.tmp 88 PID 1856 wrote to memory of 3536 1856 3691.tmp 88 PID 1856 wrote to memory of 3536 1856 3691.tmp 88 PID 3536 wrote to memory of 5060 3536 36EE.tmp 89 PID 3536 wrote to memory of 5060 3536 36EE.tmp 89 PID 3536 wrote to memory of 5060 3536 36EE.tmp 89 PID 5060 wrote to memory of 4444 5060 374C.tmp 91 PID 5060 wrote to memory of 4444 5060 374C.tmp 91 PID 5060 wrote to memory of 4444 5060 374C.tmp 91 PID 4444 wrote to memory of 1760 4444 379A.tmp 93 PID 4444 wrote to memory of 1760 4444 379A.tmp 93 PID 4444 wrote to memory of 1760 4444 379A.tmp 93 PID 1760 wrote to memory of 456 1760 3808.tmp 94 PID 1760 wrote to memory of 456 1760 3808.tmp 94 PID 1760 wrote to memory of 456 1760 3808.tmp 94 PID 456 wrote to memory of 1320 456 3865.tmp 96 PID 456 wrote to memory of 1320 456 3865.tmp 96 PID 456 wrote to memory of 1320 456 3865.tmp 96 PID 1320 wrote to memory of 3836 1320 38C3.tmp 97 PID 1320 wrote to memory of 3836 1320 38C3.tmp 97 PID 1320 wrote to memory of 3836 1320 38C3.tmp 97 PID 3836 wrote to memory of 3964 3836 3930.tmp 98 PID 3836 wrote to memory of 3964 3836 3930.tmp 98 PID 3836 wrote to memory of 3964 3836 3930.tmp 98 PID 3964 wrote to memory of 4608 3964 397F.tmp 99 PID 3964 wrote to memory of 4608 3964 397F.tmp 99 PID 3964 wrote to memory of 4608 3964 397F.tmp 99 PID 4608 wrote to memory of 4620 4608 39CD.tmp 100 PID 4608 wrote to memory of 4620 4608 39CD.tmp 100 PID 4608 wrote to memory of 4620 4608 39CD.tmp 100 PID 4620 wrote to memory of 3780 4620 3A3A.tmp 101 PID 4620 wrote to memory of 3780 4620 3A3A.tmp 101 PID 4620 wrote to memory of 3780 4620 3A3A.tmp 101 PID 3780 wrote to memory of 3256 3780 3A98.tmp 102 PID 3780 wrote to memory of 3256 3780 3A98.tmp 102 PID 3780 wrote to memory of 3256 3780 3A98.tmp 102 PID 3256 wrote to memory of 748 3256 3B15.tmp 103 PID 3256 wrote to memory of 748 3256 3B15.tmp 103 PID 3256 wrote to memory of 748 3256 3B15.tmp 103 PID 748 wrote to memory of 1600 748 3B63.tmp 104 PID 748 wrote to memory of 1600 748 3B63.tmp 104 PID 748 wrote to memory of 1600 748 3B63.tmp 104 PID 1600 wrote to memory of 4336 1600 3BD0.tmp 105 PID 1600 wrote to memory of 4336 1600 3BD0.tmp 105 PID 1600 wrote to memory of 4336 1600 3BD0.tmp 105 PID 4336 wrote to memory of 8 4336 3C2E.tmp 106 PID 4336 wrote to memory of 8 4336 3C2E.tmp 106 PID 4336 wrote to memory of 8 4336 3C2E.tmp 106 PID 8 wrote to memory of 3104 8 3C7C.tmp 107 PID 8 wrote to memory of 3104 8 3C7C.tmp 107 PID 8 wrote to memory of 3104 8 3C7C.tmp 107 PID 3104 wrote to memory of 4540 3104 3CF9.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_8780488424f30ee48fc3ba8bc86d253d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3691.tmp"C:\Users\Admin\AppData\Local\Temp\3691.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\3808.tmp"C:\Users\Admin\AppData\Local\Temp\3808.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"23⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"24⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"25⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"26⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"27⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"28⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"29⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"30⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"31⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"32⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"33⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"34⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"35⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"36⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"37⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"38⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"39⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"40⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"41⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"42⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"43⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"44⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"45⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"46⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"47⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"48⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"49⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"50⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"51⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"52⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"53⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"54⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"55⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"56⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"57⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"58⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"59⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"60⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"61⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"62⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"63⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"64⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"65⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"66⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"67⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"68⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"69⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"70⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"71⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"72⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"73⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"74⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"75⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"76⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"77⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"78⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"79⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"80⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"81⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"82⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"83⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"84⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"85⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"86⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"87⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"89⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"90⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"91⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"92⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"93⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"94⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"95⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"96⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"97⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"98⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"99⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"100⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"101⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"102⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"103⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"104⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"105⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"106⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"107⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"108⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"109⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"110⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"111⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"112⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"113⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"114⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"115⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"116⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"117⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"118⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"119⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"120⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"121⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-