Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe
-
Size
530KB
-
MD5
37cfa7412dc367e328cfd68e50d698a1
-
SHA1
152a361ba50df63f73b4134608aba0f7512eadd9
-
SHA256
5148f6e51bf46d1add2ebd968c9030c29a7083c0184ade25a2cf4e515879c564
-
SHA512
db1671173b8242d0d60a619af1ce3207e8687db906bca126754666bb92826a6f84ac065b52b7a8e8d83f672296f6417ede39e72c68d5dedb28a085cb5ff30fe4
-
SSDEEP
12288:AU5rCOTeioNdoMSI8bLGV5Q+jq2LLOd6NZulFVg0M1:AUQOJoN+MqbLGVOUq2C6NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4372 4F0A.tmp 1592 4F97.tmp 644 4FF5.tmp 2892 5062.tmp 1408 50B0.tmp 5104 511D.tmp 4576 518B.tmp 2400 51F8.tmp 4536 5246.tmp 1600 52A4.tmp 3008 5311.tmp 528 537F.tmp 2796 53EC.tmp 1236 543A.tmp 2152 5498.tmp 756 5505.tmp 1632 5573.tmp 2016 55D1.tmp 2104 561F.tmp 1992 567C.tmp 4656 56CB.tmp 2628 5719.tmp 4236 5786.tmp 1220 57D4.tmp 2812 5832.tmp 2436 5880.tmp 3388 58DE.tmp 4264 593C.tmp 3244 59A9.tmp 5056 59F7.tmp 1852 5A64.tmp 4736 5AD2.tmp 1940 5B30.tmp 2508 5B7E.tmp 4512 5BCC.tmp 3928 5C1A.tmp 548 5C78.tmp 752 5CC6.tmp 2108 5D14.tmp 5080 5D62.tmp 4960 5DB0.tmp 2976 5DFE.tmp 1232 5E4C.tmp 3216 5EAA.tmp 4348 5EE9.tmp 3540 5F37.tmp 2204 5FA4.tmp 2144 5FF2.tmp 1772 6040.tmp 2712 608F.tmp 1936 60DD.tmp 2912 612B.tmp 1816 6189.tmp 2804 61E6.tmp 4408 6225.tmp 1420 6273.tmp 5084 62D1.tmp 4296 632E.tmp 4392 637D.tmp 2292 63EA.tmp 4760 6448.tmp 2300 6486.tmp 2168 64F4.tmp 1224 6542.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 4372 3392 2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe 83 PID 3392 wrote to memory of 4372 3392 2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe 83 PID 3392 wrote to memory of 4372 3392 2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe 83 PID 4372 wrote to memory of 1592 4372 4F0A.tmp 84 PID 4372 wrote to memory of 1592 4372 4F0A.tmp 84 PID 4372 wrote to memory of 1592 4372 4F0A.tmp 84 PID 1592 wrote to memory of 644 1592 4F97.tmp 85 PID 1592 wrote to memory of 644 1592 4F97.tmp 85 PID 1592 wrote to memory of 644 1592 4F97.tmp 85 PID 644 wrote to memory of 2892 644 4FF5.tmp 86 PID 644 wrote to memory of 2892 644 4FF5.tmp 86 PID 644 wrote to memory of 2892 644 4FF5.tmp 86 PID 2892 wrote to memory of 1408 2892 5062.tmp 87 PID 2892 wrote to memory of 1408 2892 5062.tmp 87 PID 2892 wrote to memory of 1408 2892 5062.tmp 87 PID 1408 wrote to memory of 5104 1408 50B0.tmp 88 PID 1408 wrote to memory of 5104 1408 50B0.tmp 88 PID 1408 wrote to memory of 5104 1408 50B0.tmp 88 PID 5104 wrote to memory of 4576 5104 511D.tmp 89 PID 5104 wrote to memory of 4576 5104 511D.tmp 89 PID 5104 wrote to memory of 4576 5104 511D.tmp 89 PID 4576 wrote to memory of 2400 4576 518B.tmp 90 PID 4576 wrote to memory of 2400 4576 518B.tmp 90 PID 4576 wrote to memory of 2400 4576 518B.tmp 90 PID 2400 wrote to memory of 4536 2400 51F8.tmp 91 PID 2400 wrote to memory of 4536 2400 51F8.tmp 91 PID 2400 wrote to memory of 4536 2400 51F8.tmp 91 PID 4536 wrote to memory of 1600 4536 5246.tmp 92 PID 4536 wrote to memory of 1600 4536 5246.tmp 92 PID 4536 wrote to memory of 1600 4536 5246.tmp 92 PID 1600 wrote to memory of 3008 1600 52A4.tmp 93 PID 1600 wrote to memory of 3008 1600 52A4.tmp 93 PID 1600 wrote to memory of 3008 1600 52A4.tmp 93 PID 3008 wrote to memory of 528 3008 5311.tmp 94 PID 3008 wrote to memory of 528 3008 5311.tmp 94 PID 3008 wrote to memory of 528 3008 5311.tmp 94 PID 528 wrote to memory of 2796 528 537F.tmp 95 PID 528 wrote to memory of 2796 528 537F.tmp 95 PID 528 wrote to memory of 2796 528 537F.tmp 95 PID 2796 wrote to memory of 1236 2796 53EC.tmp 96 PID 2796 wrote to memory of 1236 2796 53EC.tmp 96 PID 2796 wrote to memory of 1236 2796 53EC.tmp 96 PID 1236 wrote to memory of 2152 1236 543A.tmp 97 PID 1236 wrote to memory of 2152 1236 543A.tmp 97 PID 1236 wrote to memory of 2152 1236 543A.tmp 97 PID 2152 wrote to memory of 756 2152 5498.tmp 98 PID 2152 wrote to memory of 756 2152 5498.tmp 98 PID 2152 wrote to memory of 756 2152 5498.tmp 98 PID 756 wrote to memory of 1632 756 5505.tmp 99 PID 756 wrote to memory of 1632 756 5505.tmp 99 PID 756 wrote to memory of 1632 756 5505.tmp 99 PID 1632 wrote to memory of 2016 1632 5573.tmp 100 PID 1632 wrote to memory of 2016 1632 5573.tmp 100 PID 1632 wrote to memory of 2016 1632 5573.tmp 100 PID 2016 wrote to memory of 2104 2016 55D1.tmp 101 PID 2016 wrote to memory of 2104 2016 55D1.tmp 101 PID 2016 wrote to memory of 2104 2016 55D1.tmp 101 PID 2104 wrote to memory of 1992 2104 561F.tmp 102 PID 2104 wrote to memory of 1992 2104 561F.tmp 102 PID 2104 wrote to memory of 1992 2104 561F.tmp 102 PID 1992 wrote to memory of 4656 1992 567C.tmp 103 PID 1992 wrote to memory of 4656 1992 567C.tmp 103 PID 1992 wrote to memory of 4656 1992 567C.tmp 103 PID 4656 wrote to memory of 2628 4656 56CB.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_37cfa7412dc367e328cfd68e50d698a1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"23⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"24⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"25⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"27⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"28⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"29⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"30⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"31⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"32⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"33⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"34⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"35⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"36⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"37⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"38⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"39⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"40⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"41⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"42⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"43⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"44⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"45⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"46⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"47⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"48⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"49⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"50⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"51⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"52⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"53⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"54⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"55⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"56⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"57⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"58⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"59⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"60⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"61⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"62⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"63⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"64⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"65⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"66⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"67⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"68⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"69⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"70⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"71⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"72⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"73⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"74⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"75⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"76⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"77⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"78⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"79⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"80⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"81⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"82⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"83⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"84⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"85⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"86⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"88⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"89⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"90⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"91⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"92⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"94⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"95⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"96⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"97⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"98⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"99⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"100⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"101⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"102⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"103⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"104⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"105⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"106⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"107⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"108⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"109⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"110⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"111⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"112⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"113⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"114⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"115⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"116⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"117⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"118⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"119⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"120⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"121⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"122⤵PID:5020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-