Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe
-
Size
527KB
-
MD5
04ecb935a14810973da452f1c1eb5c41
-
SHA1
e3160de32e416567a20f04e6db5d074dd9b39581
-
SHA256
b0d561b64298e196b7772042fee79ee6658d772b0ac53556a3b213e8b4c51227
-
SHA512
68b43abc4b0eb338a27b5f8921583e65a572530cfd37c53c6ef7c8139e6cdce368ff50977189a2e85d4cc6a9797f9cab1b69d182e043840466aef148c4c5c78f
-
SSDEEP
12288:fU5rCOTeid2Ly7H7OFk6njMSzWtBp9SDa9DZu:fUQOJdoyb7Mn5mSO9Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3068 2AD9.tmp 940 2B36.tmp 4992 2B94.tmp 3304 2BE2.tmp 3780 2C40.tmp 380 2CAD.tmp 2400 2D0B.tmp 3420 2D78.tmp 2524 2DD6.tmp 2896 2E24.tmp 2968 2E82.tmp 4488 2EE0.tmp 2232 2F3E.tmp 1636 2FAB.tmp 3056 2FE9.tmp 4836 3038.tmp 3680 319F.tmp 2992 320C.tmp 2796 326A.tmp 4292 32B8.tmp 1704 3306.tmp 4900 3354.tmp 1412 33C2.tmp 1664 343F.tmp 3080 34BC.tmp 3748 3529.tmp 4768 3597.tmp 2712 35F4.tmp 1096 3662.tmp 3396 36CF.tmp 2588 372D.tmp 3944 378B.tmp 4624 37D9.tmp 4864 3827.tmp 3376 3875.tmp 400 38D3.tmp 4144 3921.tmp 1040 396F.tmp 448 39BD.tmp 4264 3A0B.tmp 4216 3A59.tmp 4128 3AA7.tmp 4620 3AF6.tmp 1340 3B53.tmp 3828 3BA1.tmp 4288 3BF0.tmp 2252 3C2E.tmp 4940 3C7C.tmp 2524 3CCA.tmp 4816 3D28.tmp 5112 3D86.tmp 3684 3DE4.tmp 3884 3E32.tmp 4488 3E80.tmp 4608 3EDE.tmp 3012 3F2C.tmp 2336 3F89.tmp 4312 3FE7.tmp 388 4035.tmp 1280 4083.tmp 3820 40E1.tmp 1160 412F.tmp 2812 417D.tmp 3400 41CC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 3068 1496 2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe 83 PID 1496 wrote to memory of 3068 1496 2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe 83 PID 1496 wrote to memory of 3068 1496 2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe 83 PID 3068 wrote to memory of 940 3068 2AD9.tmp 84 PID 3068 wrote to memory of 940 3068 2AD9.tmp 84 PID 3068 wrote to memory of 940 3068 2AD9.tmp 84 PID 940 wrote to memory of 4992 940 2B36.tmp 85 PID 940 wrote to memory of 4992 940 2B36.tmp 85 PID 940 wrote to memory of 4992 940 2B36.tmp 85 PID 4992 wrote to memory of 3304 4992 2B94.tmp 86 PID 4992 wrote to memory of 3304 4992 2B94.tmp 86 PID 4992 wrote to memory of 3304 4992 2B94.tmp 86 PID 3304 wrote to memory of 3780 3304 2BE2.tmp 87 PID 3304 wrote to memory of 3780 3304 2BE2.tmp 87 PID 3304 wrote to memory of 3780 3304 2BE2.tmp 87 PID 3780 wrote to memory of 380 3780 2C40.tmp 88 PID 3780 wrote to memory of 380 3780 2C40.tmp 88 PID 3780 wrote to memory of 380 3780 2C40.tmp 88 PID 380 wrote to memory of 2400 380 2CAD.tmp 90 PID 380 wrote to memory of 2400 380 2CAD.tmp 90 PID 380 wrote to memory of 2400 380 2CAD.tmp 90 PID 2400 wrote to memory of 3420 2400 2D0B.tmp 93 PID 2400 wrote to memory of 3420 2400 2D0B.tmp 93 PID 2400 wrote to memory of 3420 2400 2D0B.tmp 93 PID 3420 wrote to memory of 2524 3420 2D78.tmp 94 PID 3420 wrote to memory of 2524 3420 2D78.tmp 94 PID 3420 wrote to memory of 2524 3420 2D78.tmp 94 PID 2524 wrote to memory of 2896 2524 2DD6.tmp 96 PID 2524 wrote to memory of 2896 2524 2DD6.tmp 96 PID 2524 wrote to memory of 2896 2524 2DD6.tmp 96 PID 2896 wrote to memory of 2968 2896 2E24.tmp 97 PID 2896 wrote to memory of 2968 2896 2E24.tmp 97 PID 2896 wrote to memory of 2968 2896 2E24.tmp 97 PID 2968 wrote to memory of 4488 2968 2E82.tmp 98 PID 2968 wrote to memory of 4488 2968 2E82.tmp 98 PID 2968 wrote to memory of 4488 2968 2E82.tmp 98 PID 4488 wrote to memory of 2232 4488 2EE0.tmp 99 PID 4488 wrote to memory of 2232 4488 2EE0.tmp 99 PID 4488 wrote to memory of 2232 4488 2EE0.tmp 99 PID 2232 wrote to memory of 1636 2232 2F3E.tmp 100 PID 2232 wrote to memory of 1636 2232 2F3E.tmp 100 PID 2232 wrote to memory of 1636 2232 2F3E.tmp 100 PID 1636 wrote to memory of 3056 1636 2FAB.tmp 101 PID 1636 wrote to memory of 3056 1636 2FAB.tmp 101 PID 1636 wrote to memory of 3056 1636 2FAB.tmp 101 PID 3056 wrote to memory of 4836 3056 2FE9.tmp 102 PID 3056 wrote to memory of 4836 3056 2FE9.tmp 102 PID 3056 wrote to memory of 4836 3056 2FE9.tmp 102 PID 4836 wrote to memory of 3680 4836 3038.tmp 103 PID 4836 wrote to memory of 3680 4836 3038.tmp 103 PID 4836 wrote to memory of 3680 4836 3038.tmp 103 PID 3680 wrote to memory of 2992 3680 319F.tmp 104 PID 3680 wrote to memory of 2992 3680 319F.tmp 104 PID 3680 wrote to memory of 2992 3680 319F.tmp 104 PID 2992 wrote to memory of 2796 2992 320C.tmp 105 PID 2992 wrote to memory of 2796 2992 320C.tmp 105 PID 2992 wrote to memory of 2796 2992 320C.tmp 105 PID 2796 wrote to memory of 4292 2796 326A.tmp 106 PID 2796 wrote to memory of 4292 2796 326A.tmp 106 PID 2796 wrote to memory of 4292 2796 326A.tmp 106 PID 4292 wrote to memory of 1704 4292 32B8.tmp 107 PID 4292 wrote to memory of 1704 4292 32B8.tmp 107 PID 4292 wrote to memory of 1704 4292 32B8.tmp 107 PID 1704 wrote to memory of 4900 1704 3306.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_04ecb935a14810973da452f1c1eb5c41_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"C:\Users\Admin\AppData\Local\Temp\2AD9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2B36.tmp"C:\Users\Admin\AppData\Local\Temp\2B36.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2B94.tmp"C:\Users\Admin\AppData\Local\Temp\2B94.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"C:\Users\Admin\AppData\Local\Temp\2BE2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\2C40.tmp"C:\Users\Admin\AppData\Local\Temp\2C40.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\2D0B.tmp"C:\Users\Admin\AppData\Local\Temp\2D0B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2D78.tmp"C:\Users\Admin\AppData\Local\Temp\2D78.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\2DD6.tmp"C:\Users\Admin\AppData\Local\Temp\2DD6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2E24.tmp"C:\Users\Admin\AppData\Local\Temp\2E24.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2E82.tmp"C:\Users\Admin\AppData\Local\Temp\2E82.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2EE0.tmp"C:\Users\Admin\AppData\Local\Temp\2EE0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"C:\Users\Admin\AppData\Local\Temp\2FAB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2FE9.tmp"C:\Users\Admin\AppData\Local\Temp\2FE9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3038.tmp"C:\Users\Admin\AppData\Local\Temp\3038.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\320C.tmp"C:\Users\Admin\AppData\Local\Temp\320C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\326A.tmp"C:\Users\Admin\AppData\Local\Temp\326A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\32B8.tmp"C:\Users\Admin\AppData\Local\Temp\32B8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3306.tmp"C:\Users\Admin\AppData\Local\Temp\3306.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"23⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"24⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"25⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"26⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"27⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"28⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"29⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"30⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"31⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\372D.tmp"C:\Users\Admin\AppData\Local\Temp\372D.tmp"32⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"33⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"34⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"35⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"36⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\38D3.tmp"C:\Users\Admin\AppData\Local\Temp\38D3.tmp"37⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"38⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"39⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"40⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"41⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"42⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"43⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"44⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"45⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"46⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"47⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"48⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"49⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"50⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"51⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"52⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"53⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"54⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"55⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"56⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"57⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"58⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"59⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"60⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"61⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"62⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"63⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"64⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"65⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"66⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"67⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"68⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"69⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"70⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"71⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"72⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"73⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"74⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"75⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"76⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"77⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"78⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"79⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"80⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"81⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"82⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"83⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"84⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"85⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"86⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"87⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"88⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"89⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"90⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"91⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"92⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"93⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"94⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"95⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"96⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"97⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"98⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"99⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"100⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"101⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"102⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"103⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"105⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"106⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"107⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"108⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"109⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"110⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"111⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"112⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"113⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"114⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"115⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"116⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"117⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"118⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"119⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"120⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"121⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-