Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 15:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe
-
Size
486KB
-
MD5
42517dbb6687ea5ff8b65e61d0dff3c7
-
SHA1
31a8c4eeb6351f14b1f21a09b3840ac10d317333
-
SHA256
d2b700efc91649e39ad85f7ab5e70ee32083936e5b51cb95e4a2df145058f776
-
SHA512
aefaecde07a53ce3d88cab8ea25326bbe9696862841e109060d10377f9c197cc081bb3d8f3e6eaff7798c91af171d85348441c124c3906cfa33bcc942486d8d3
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD73Q7W3dZGfulTI5oR4w2u9amWio31CIsH3dZ:/U5rCOTeiDAC3madRnvBWi4CRNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1276 498C.tmp 4916 49EA.tmp 5024 4A47.tmp 376 4AC4.tmp 1648 4B22.tmp 2176 4B70.tmp 3172 4BCE.tmp 1144 4C2C.tmp 1076 4CA9.tmp 224 4D07.tmp 4612 4D64.tmp 3904 4DD2.tmp 3216 4E2F.tmp 4972 4E8D.tmp 4540 4EFB.tmp 3688 4F68.tmp 3744 4FC6.tmp 4372 5043.tmp 3248 50A0.tmp 1984 510E.tmp 900 516C.tmp 3492 51D9.tmp 1332 5237.tmp 888 52B4.tmp 4384 5321.tmp 2996 537F.tmp 4492 53CD.tmp 3924 543A.tmp 3604 5498.tmp 3120 5525.tmp 368 5592.tmp 4884 55F0.tmp 388 565D.tmp 2896 56AB.tmp 4232 56F9.tmp 2228 5757.tmp 4912 5822.tmp 5000 5870.tmp 2660 58CE.tmp 3064 591C.tmp 1648 596A.tmp 688 59B9.tmp 116 5A16.tmp 5052 5A93.tmp 2268 5AF1.tmp 3928 5B3F.tmp 3452 5B9D.tmp 2348 5BFB.tmp 2512 5C49.tmp 980 5CB6.tmp 3224 5D04.tmp 3200 5D52.tmp 2684 5DB0.tmp 4068 5E0E.tmp 2788 5E6C.tmp 532 5EBA.tmp 2752 5F18.tmp 2680 5F75.tmp 1020 5FD3.tmp 5108 6031.tmp 4332 608F.tmp 1248 60EC.tmp 2488 614A.tmp 3492 61A8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1276 1900 2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe 85 PID 1900 wrote to memory of 1276 1900 2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe 85 PID 1900 wrote to memory of 1276 1900 2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe 85 PID 1276 wrote to memory of 4916 1276 498C.tmp 86 PID 1276 wrote to memory of 4916 1276 498C.tmp 86 PID 1276 wrote to memory of 4916 1276 498C.tmp 86 PID 4916 wrote to memory of 5024 4916 49EA.tmp 88 PID 4916 wrote to memory of 5024 4916 49EA.tmp 88 PID 4916 wrote to memory of 5024 4916 49EA.tmp 88 PID 5024 wrote to memory of 376 5024 4A47.tmp 90 PID 5024 wrote to memory of 376 5024 4A47.tmp 90 PID 5024 wrote to memory of 376 5024 4A47.tmp 90 PID 376 wrote to memory of 1648 376 4AC4.tmp 92 PID 376 wrote to memory of 1648 376 4AC4.tmp 92 PID 376 wrote to memory of 1648 376 4AC4.tmp 92 PID 1648 wrote to memory of 2176 1648 4B22.tmp 93 PID 1648 wrote to memory of 2176 1648 4B22.tmp 93 PID 1648 wrote to memory of 2176 1648 4B22.tmp 93 PID 2176 wrote to memory of 3172 2176 4B70.tmp 94 PID 2176 wrote to memory of 3172 2176 4B70.tmp 94 PID 2176 wrote to memory of 3172 2176 4B70.tmp 94 PID 3172 wrote to memory of 1144 3172 4BCE.tmp 95 PID 3172 wrote to memory of 1144 3172 4BCE.tmp 95 PID 3172 wrote to memory of 1144 3172 4BCE.tmp 95 PID 1144 wrote to memory of 1076 1144 4C2C.tmp 96 PID 1144 wrote to memory of 1076 1144 4C2C.tmp 96 PID 1144 wrote to memory of 1076 1144 4C2C.tmp 96 PID 1076 wrote to memory of 224 1076 4CA9.tmp 97 PID 1076 wrote to memory of 224 1076 4CA9.tmp 97 PID 1076 wrote to memory of 224 1076 4CA9.tmp 97 PID 224 wrote to memory of 4612 224 4D07.tmp 98 PID 224 wrote to memory of 4612 224 4D07.tmp 98 PID 224 wrote to memory of 4612 224 4D07.tmp 98 PID 4612 wrote to memory of 3904 4612 4D64.tmp 99 PID 4612 wrote to memory of 3904 4612 4D64.tmp 99 PID 4612 wrote to memory of 3904 4612 4D64.tmp 99 PID 3904 wrote to memory of 3216 3904 4DD2.tmp 100 PID 3904 wrote to memory of 3216 3904 4DD2.tmp 100 PID 3904 wrote to memory of 3216 3904 4DD2.tmp 100 PID 3216 wrote to memory of 4972 3216 4E2F.tmp 101 PID 3216 wrote to memory of 4972 3216 4E2F.tmp 101 PID 3216 wrote to memory of 4972 3216 4E2F.tmp 101 PID 4972 wrote to memory of 4540 4972 4E8D.tmp 102 PID 4972 wrote to memory of 4540 4972 4E8D.tmp 102 PID 4972 wrote to memory of 4540 4972 4E8D.tmp 102 PID 4540 wrote to memory of 3688 4540 4EFB.tmp 103 PID 4540 wrote to memory of 3688 4540 4EFB.tmp 103 PID 4540 wrote to memory of 3688 4540 4EFB.tmp 103 PID 3688 wrote to memory of 3744 3688 4F68.tmp 104 PID 3688 wrote to memory of 3744 3688 4F68.tmp 104 PID 3688 wrote to memory of 3744 3688 4F68.tmp 104 PID 3744 wrote to memory of 4372 3744 4FC6.tmp 105 PID 3744 wrote to memory of 4372 3744 4FC6.tmp 105 PID 3744 wrote to memory of 4372 3744 4FC6.tmp 105 PID 4372 wrote to memory of 3248 4372 5043.tmp 106 PID 4372 wrote to memory of 3248 4372 5043.tmp 106 PID 4372 wrote to memory of 3248 4372 5043.tmp 106 PID 3248 wrote to memory of 1984 3248 50A0.tmp 107 PID 3248 wrote to memory of 1984 3248 50A0.tmp 107 PID 3248 wrote to memory of 1984 3248 50A0.tmp 107 PID 1984 wrote to memory of 900 1984 510E.tmp 108 PID 1984 wrote to memory of 900 1984 510E.tmp 108 PID 1984 wrote to memory of 900 1984 510E.tmp 108 PID 900 wrote to memory of 3492 900 516C.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_42517dbb6687ea5ff8b65e61d0dff3c7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"23⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"24⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"25⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"26⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"27⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"28⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"29⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"30⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"31⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"32⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"33⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"34⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"35⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"36⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"37⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"38⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"39⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"40⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"41⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"42⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"43⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"44⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"45⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"46⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"47⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"48⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"49⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"50⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"51⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"52⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"53⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"54⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"55⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"56⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"57⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"58⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"59⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"60⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"61⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"62⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"63⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"64⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"65⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"66⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"67⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"68⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"69⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"70⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"71⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"72⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"73⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"74⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"75⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"76⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"77⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"78⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"79⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"80⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"81⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"82⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"83⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"84⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"85⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"86⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"88⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"89⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"90⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"91⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"92⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"93⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"94⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"95⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"96⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"97⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"98⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"100⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"101⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"102⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"103⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"104⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"105⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"106⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"107⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"108⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"109⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"110⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"111⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"112⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"113⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"114⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"115⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"116⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"117⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"118⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"119⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"120⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"121⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"122⤵PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-