Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe
-
Size
712KB
-
MD5
dd53197d22f476933ed1164a30e7e757
-
SHA1
206b041760f8daa9b560437e4a1b1701a142bb4d
-
SHA256
ae6a314fc5160acb3239d1c64c578b365a03c0032b209c86eb54818cbfe0a310
-
SHA512
c5bedffce7cc3853ab807bd3b95a7a57a9be387eaada1fa641f635176df4df6546ce7def0f204eb8c2b2302e064db720e445f126b50cfd8dcf24c66cb3b622f0
-
SSDEEP
12288:FU5rCOTeiDUkb2h9RdizemuNRcOOa2Q3oFp5mG+uNZdCvq5TJLCvY90D8/LVBlVF:FUQOJDTGjNc3QYH1NnCvq5TJLCvY90DA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 940 421A.tmp 1928 42B6.tmp 4460 4343.tmp 1548 43DF.tmp 1436 445C.tmp 3800 44C9.tmp 4032 4527.tmp 4984 4594.tmp 1640 4611.tmp 4676 466F.tmp 3216 46DC.tmp 3552 4769.tmp 4488 47C7.tmp 2008 4825.tmp 1672 48B1.tmp 828 48FF.tmp 3268 495D.tmp 632 49EA.tmp 2656 4A57.tmp 440 4AC4.tmp 2012 4B32.tmp 1452 4BAF.tmp 3960 4C0D.tmp 396 4C8A.tmp 4700 4CE7.tmp 2708 4D35.tmp 4688 4DC2.tmp 3808 4E3F.tmp 1752 4EBC.tmp 4908 4F39.tmp 5088 4F97.tmp 3896 5004.tmp 4820 5072.tmp 4440 50C0.tmp 1728 510E.tmp 2948 515C.tmp 4060 51AA.tmp 4988 51F8.tmp 4472 5256.tmp 4324 52B4.tmp 3152 5311.tmp 2996 5360.tmp 1256 53BD.tmp 4936 540B.tmp 3800 5469.tmp 2360 54B7.tmp 4368 5505.tmp 464 5554.tmp 1100 55B1.tmp 4872 560F.tmp 2440 565D.tmp 1660 56BB.tmp 2928 5709.tmp 5000 5767.tmp 2680 57B5.tmp 4764 5803.tmp 2328 5861.tmp 704 58BF.tmp 624 591C.tmp 436 597A.tmp 1556 59C8.tmp 4532 5A26.tmp 3428 5A84.tmp 4904 5AE1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 940 964 2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe 83 PID 964 wrote to memory of 940 964 2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe 83 PID 964 wrote to memory of 940 964 2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe 83 PID 940 wrote to memory of 1928 940 421A.tmp 84 PID 940 wrote to memory of 1928 940 421A.tmp 84 PID 940 wrote to memory of 1928 940 421A.tmp 84 PID 1928 wrote to memory of 4460 1928 42B6.tmp 85 PID 1928 wrote to memory of 4460 1928 42B6.tmp 85 PID 1928 wrote to memory of 4460 1928 42B6.tmp 85 PID 4460 wrote to memory of 1548 4460 4343.tmp 86 PID 4460 wrote to memory of 1548 4460 4343.tmp 86 PID 4460 wrote to memory of 1548 4460 4343.tmp 86 PID 1548 wrote to memory of 1436 1548 43DF.tmp 88 PID 1548 wrote to memory of 1436 1548 43DF.tmp 88 PID 1548 wrote to memory of 1436 1548 43DF.tmp 88 PID 1436 wrote to memory of 3800 1436 445C.tmp 90 PID 1436 wrote to memory of 3800 1436 445C.tmp 90 PID 1436 wrote to memory of 3800 1436 445C.tmp 90 PID 3800 wrote to memory of 4032 3800 44C9.tmp 92 PID 3800 wrote to memory of 4032 3800 44C9.tmp 92 PID 3800 wrote to memory of 4032 3800 44C9.tmp 92 PID 4032 wrote to memory of 4984 4032 4527.tmp 93 PID 4032 wrote to memory of 4984 4032 4527.tmp 93 PID 4032 wrote to memory of 4984 4032 4527.tmp 93 PID 4984 wrote to memory of 1640 4984 4594.tmp 94 PID 4984 wrote to memory of 1640 4984 4594.tmp 94 PID 4984 wrote to memory of 1640 4984 4594.tmp 94 PID 1640 wrote to memory of 4676 1640 4611.tmp 95 PID 1640 wrote to memory of 4676 1640 4611.tmp 95 PID 1640 wrote to memory of 4676 1640 4611.tmp 95 PID 4676 wrote to memory of 3216 4676 466F.tmp 96 PID 4676 wrote to memory of 3216 4676 466F.tmp 96 PID 4676 wrote to memory of 3216 4676 466F.tmp 96 PID 3216 wrote to memory of 3552 3216 46DC.tmp 97 PID 3216 wrote to memory of 3552 3216 46DC.tmp 97 PID 3216 wrote to memory of 3552 3216 46DC.tmp 97 PID 3552 wrote to memory of 4488 3552 4769.tmp 98 PID 3552 wrote to memory of 4488 3552 4769.tmp 98 PID 3552 wrote to memory of 4488 3552 4769.tmp 98 PID 4488 wrote to memory of 2008 4488 47C7.tmp 99 PID 4488 wrote to memory of 2008 4488 47C7.tmp 99 PID 4488 wrote to memory of 2008 4488 47C7.tmp 99 PID 2008 wrote to memory of 1672 2008 4825.tmp 100 PID 2008 wrote to memory of 1672 2008 4825.tmp 100 PID 2008 wrote to memory of 1672 2008 4825.tmp 100 PID 1672 wrote to memory of 828 1672 48B1.tmp 101 PID 1672 wrote to memory of 828 1672 48B1.tmp 101 PID 1672 wrote to memory of 828 1672 48B1.tmp 101 PID 828 wrote to memory of 3268 828 48FF.tmp 102 PID 828 wrote to memory of 3268 828 48FF.tmp 102 PID 828 wrote to memory of 3268 828 48FF.tmp 102 PID 3268 wrote to memory of 632 3268 495D.tmp 103 PID 3268 wrote to memory of 632 3268 495D.tmp 103 PID 3268 wrote to memory of 632 3268 495D.tmp 103 PID 632 wrote to memory of 2656 632 49EA.tmp 104 PID 632 wrote to memory of 2656 632 49EA.tmp 104 PID 632 wrote to memory of 2656 632 49EA.tmp 104 PID 2656 wrote to memory of 440 2656 4A57.tmp 105 PID 2656 wrote to memory of 440 2656 4A57.tmp 105 PID 2656 wrote to memory of 440 2656 4A57.tmp 105 PID 440 wrote to memory of 2012 440 4AC4.tmp 106 PID 440 wrote to memory of 2012 440 4AC4.tmp 106 PID 440 wrote to memory of 2012 440 4AC4.tmp 106 PID 2012 wrote to memory of 1452 2012 4B32.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_dd53197d22f476933ed1164a30e7e757_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"23⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"24⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"25⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"26⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"27⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"28⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"29⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"30⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"31⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"32⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"33⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"34⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"35⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"36⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"37⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"38⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"39⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"40⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"41⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"42⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"43⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"44⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"45⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"46⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"47⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"48⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"49⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"50⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"51⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"52⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"53⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"54⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"55⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"56⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"57⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"58⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"59⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"60⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"61⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"62⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"63⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"64⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"65⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"66⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"67⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"68⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"69⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"70⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"71⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"72⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"73⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"74⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"75⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"76⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"77⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"78⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"79⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"80⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"81⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"82⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"83⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"84⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"85⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"86⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"87⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"88⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"89⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"90⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"91⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"92⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"93⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"94⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"95⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"96⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"98⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"99⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"100⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"101⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"102⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"103⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"104⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"105⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"106⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"107⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"109⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"110⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"111⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"113⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"114⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"116⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"117⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"118⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"119⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"120⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"121⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"122⤵PID:3980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-