Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 07:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe
-
Size
520KB
-
MD5
808a8a8b49f44d94373441bf7011384a
-
SHA1
c0c1355a1b881e0e1521d7ceb24da0e0eb264825
-
SHA256
2f53f18c421ec69f996474634da8d264d12a08f02d44597c2108777cfe1d7251
-
SHA512
f618b0bb6cc4880e5234c9df71d4ce39dfef25403700b4857c16694980c5419173014c622cbce9f78c0f7a6f22a58f70a12ea8fdd43fdd4c0fe981922de83074
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLFir5x1k4l6atL4ZE6eUiQmHaDRG+8I3alESUt:roRXOQjmOy1SiatLR6e796kESU8RiNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4216 34FA.tmp 8 3568.tmp 4908 35D5.tmp 3416 3642.tmp 1472 36B0.tmp 1660 377B.tmp 1152 3836.tmp 436 38C3.tmp 408 395F.tmp 4576 39DC.tmp 4552 3A69.tmp 4224 3AD6.tmp 4372 3B73.tmp 1056 3BFF.tmp 1544 3CCA.tmp 2844 3D38.tmp 3628 3DB5.tmp 1976 3E12.tmp 2996 3E9F.tmp 4744 3F1C.tmp 5004 3F7A.tmp 4000 3FD8.tmp 4128 4045.tmp 2892 40B2.tmp 1800 4120.tmp 3976 417D.tmp 2452 41CC.tmp 3804 4249.tmp 448 4297.tmp 1872 42E5.tmp 1300 4343.tmp 2592 4391.tmp 4244 43FE.tmp 5092 444C.tmp 2000 449A.tmp 3012 44E8.tmp 2268 4556.tmp 1224 45C3.tmp 4544 4631.tmp 4056 46AE.tmp 3808 471B.tmp 3076 4779.tmp 2632 47F6.tmp 3332 4863.tmp 3004 48C1.tmp 2344 492E.tmp 716 49EA.tmp 1040 4A57.tmp 8 4B03.tmp 4396 4B61.tmp 4908 4BBE.tmp 3428 4C1C.tmp 4848 4C6A.tmp 3416 4CE7.tmp 3556 4D45.tmp 4960 4DB2.tmp 1644 4E20.tmp 4872 4E7E.tmp 2036 4EDB.tmp 2236 4F39.tmp 4884 4F97.tmp 408 4FF5.tmp 4972 5062.tmp 1180 50C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 4216 1076 2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe 81 PID 1076 wrote to memory of 4216 1076 2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe 81 PID 1076 wrote to memory of 4216 1076 2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe 81 PID 4216 wrote to memory of 8 4216 34FA.tmp 83 PID 4216 wrote to memory of 8 4216 34FA.tmp 83 PID 4216 wrote to memory of 8 4216 34FA.tmp 83 PID 8 wrote to memory of 4908 8 3568.tmp 84 PID 8 wrote to memory of 4908 8 3568.tmp 84 PID 8 wrote to memory of 4908 8 3568.tmp 84 PID 4908 wrote to memory of 3416 4908 35D5.tmp 86 PID 4908 wrote to memory of 3416 4908 35D5.tmp 86 PID 4908 wrote to memory of 3416 4908 35D5.tmp 86 PID 3416 wrote to memory of 1472 3416 3642.tmp 87 PID 3416 wrote to memory of 1472 3416 3642.tmp 87 PID 3416 wrote to memory of 1472 3416 3642.tmp 87 PID 1472 wrote to memory of 1660 1472 36B0.tmp 89 PID 1472 wrote to memory of 1660 1472 36B0.tmp 89 PID 1472 wrote to memory of 1660 1472 36B0.tmp 89 PID 1660 wrote to memory of 1152 1660 377B.tmp 90 PID 1660 wrote to memory of 1152 1660 377B.tmp 90 PID 1660 wrote to memory of 1152 1660 377B.tmp 90 PID 1152 wrote to memory of 436 1152 3836.tmp 91 PID 1152 wrote to memory of 436 1152 3836.tmp 91 PID 1152 wrote to memory of 436 1152 3836.tmp 91 PID 436 wrote to memory of 408 436 38C3.tmp 92 PID 436 wrote to memory of 408 436 38C3.tmp 92 PID 436 wrote to memory of 408 436 38C3.tmp 92 PID 408 wrote to memory of 4576 408 395F.tmp 93 PID 408 wrote to memory of 4576 408 395F.tmp 93 PID 408 wrote to memory of 4576 408 395F.tmp 93 PID 4576 wrote to memory of 4552 4576 39DC.tmp 94 PID 4576 wrote to memory of 4552 4576 39DC.tmp 94 PID 4576 wrote to memory of 4552 4576 39DC.tmp 94 PID 4552 wrote to memory of 4224 4552 3A69.tmp 95 PID 4552 wrote to memory of 4224 4552 3A69.tmp 95 PID 4552 wrote to memory of 4224 4552 3A69.tmp 95 PID 4224 wrote to memory of 4372 4224 3AD6.tmp 96 PID 4224 wrote to memory of 4372 4224 3AD6.tmp 96 PID 4224 wrote to memory of 4372 4224 3AD6.tmp 96 PID 4372 wrote to memory of 1056 4372 3B73.tmp 97 PID 4372 wrote to memory of 1056 4372 3B73.tmp 97 PID 4372 wrote to memory of 1056 4372 3B73.tmp 97 PID 1056 wrote to memory of 1544 1056 3BFF.tmp 98 PID 1056 wrote to memory of 1544 1056 3BFF.tmp 98 PID 1056 wrote to memory of 1544 1056 3BFF.tmp 98 PID 1544 wrote to memory of 2844 1544 3CCA.tmp 99 PID 1544 wrote to memory of 2844 1544 3CCA.tmp 99 PID 1544 wrote to memory of 2844 1544 3CCA.tmp 99 PID 2844 wrote to memory of 3628 2844 3D38.tmp 100 PID 2844 wrote to memory of 3628 2844 3D38.tmp 100 PID 2844 wrote to memory of 3628 2844 3D38.tmp 100 PID 3628 wrote to memory of 1976 3628 3DB5.tmp 101 PID 3628 wrote to memory of 1976 3628 3DB5.tmp 101 PID 3628 wrote to memory of 1976 3628 3DB5.tmp 101 PID 1976 wrote to memory of 2996 1976 3E12.tmp 102 PID 1976 wrote to memory of 2996 1976 3E12.tmp 102 PID 1976 wrote to memory of 2996 1976 3E12.tmp 102 PID 2996 wrote to memory of 4744 2996 3E9F.tmp 103 PID 2996 wrote to memory of 4744 2996 3E9F.tmp 103 PID 2996 wrote to memory of 4744 2996 3E9F.tmp 103 PID 4744 wrote to memory of 5004 4744 3F1C.tmp 104 PID 4744 wrote to memory of 5004 4744 3F1C.tmp 104 PID 4744 wrote to memory of 5004 4744 3F1C.tmp 104 PID 5004 wrote to memory of 4000 5004 3F7A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_808a8a8b49f44d94373441bf7011384a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"23⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"24⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"25⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"26⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"27⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"28⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"29⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"30⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"31⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"32⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"33⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"34⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"35⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"36⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"37⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"38⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"39⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"40⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"41⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"42⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"43⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"44⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"45⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"46⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"47⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"48⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"49⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"50⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"51⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"52⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"53⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"54⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"55⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"56⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"57⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"58⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"59⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"60⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"61⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"62⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"63⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"64⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"65⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"66⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"67⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"68⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"69⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"70⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"71⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"72⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"73⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"74⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"75⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"76⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"77⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"78⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"80⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"81⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"82⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"83⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"84⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"85⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"86⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"87⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"88⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"89⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"90⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"91⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"92⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"93⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"94⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"95⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"96⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"97⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"98⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"100⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"101⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"102⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"103⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"104⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"105⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"106⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"107⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"108⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"109⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"110⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"111⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"112⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"114⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"115⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"116⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"117⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"118⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"120⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"121⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-