Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 06:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe
-
Size
541KB
-
MD5
73b0ae4b7b131353b1509579ff726f92
-
SHA1
e1888272d595657b319ebcd4f80b83032db7d003
-
SHA256
a87dc73c3ae2775feb931ca0460d4f655af0491f0b6ecd3c5029a2bebc336600
-
SHA512
2468f03c06e02c2257f8449aa2d466b24e7d191fdd15a47de731e466986e9aa74bf231c200a9c51ae6e0ab842dea3c63643c6b6495f25e649cb02cb492540e0b
-
SSDEEP
12288:UU5rCOTeif5Yy5bCnkqkT+i60OrZa73ctO:UUQOJf5opkTwrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4396 3D76.tmp 1736 3E32.tmp 4852 3E9F.tmp 4184 3F5B.tmp 4928 4006.tmp 2900 4074.tmp 2880 40F1.tmp 3272 417D.tmp 3888 41FA.tmp 4628 4268.tmp 1832 42E5.tmp 408 4362.tmp 4264 440E.tmp 924 448B.tmp 2632 4527.tmp 4752 4594.tmp 1544 4621.tmp 4608 468E.tmp 3336 46FC.tmp 4656 4779.tmp 2760 4805.tmp 852 4882.tmp 4380 48F0.tmp 3804 494D.tmp 3996 49BB.tmp 1676 4A57.tmp 3036 4AC4.tmp 4532 4B61.tmp 3860 4BED.tmp 2984 4C6A.tmp 432 4CF7.tmp 388 4D93.tmp 3964 4E01.tmp 908 4E5E.tmp 4224 4EBC.tmp 216 4F1A.tmp 960 4F78.tmp 4072 4FE5.tmp 4616 5043.tmp 4056 50A0.tmp 3488 50EF.tmp 4808 514C.tmp 4788 51AA.tmp 4256 5208.tmp 740 5275.tmp 2068 52E3.tmp 2992 5340.tmp 1152 539E.tmp 2176 53FC.tmp 4576 545A.tmp 2256 54C7.tmp 3304 5515.tmp 3440 5563.tmp 748 55D1.tmp 3908 563E.tmp 5084 568C.tmp 4320 56EA.tmp 4492 5757.tmp 1020 57A5.tmp 2848 5813.tmp 1084 5861.tmp 3088 58CE.tmp 1736 592C.tmp 228 598A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 4396 4736 2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe 84 PID 4736 wrote to memory of 4396 4736 2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe 84 PID 4736 wrote to memory of 4396 4736 2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe 84 PID 4396 wrote to memory of 1736 4396 3D76.tmp 85 PID 4396 wrote to memory of 1736 4396 3D76.tmp 85 PID 4396 wrote to memory of 1736 4396 3D76.tmp 85 PID 1736 wrote to memory of 4852 1736 3E32.tmp 86 PID 1736 wrote to memory of 4852 1736 3E32.tmp 86 PID 1736 wrote to memory of 4852 1736 3E32.tmp 86 PID 4852 wrote to memory of 4184 4852 3E9F.tmp 87 PID 4852 wrote to memory of 4184 4852 3E9F.tmp 87 PID 4852 wrote to memory of 4184 4852 3E9F.tmp 87 PID 4184 wrote to memory of 4928 4184 3F5B.tmp 88 PID 4184 wrote to memory of 4928 4184 3F5B.tmp 88 PID 4184 wrote to memory of 4928 4184 3F5B.tmp 88 PID 4928 wrote to memory of 2900 4928 4006.tmp 89 PID 4928 wrote to memory of 2900 4928 4006.tmp 89 PID 4928 wrote to memory of 2900 4928 4006.tmp 89 PID 2900 wrote to memory of 2880 2900 4074.tmp 90 PID 2900 wrote to memory of 2880 2900 4074.tmp 90 PID 2900 wrote to memory of 2880 2900 4074.tmp 90 PID 2880 wrote to memory of 3272 2880 40F1.tmp 91 PID 2880 wrote to memory of 3272 2880 40F1.tmp 91 PID 2880 wrote to memory of 3272 2880 40F1.tmp 91 PID 3272 wrote to memory of 3888 3272 417D.tmp 92 PID 3272 wrote to memory of 3888 3272 417D.tmp 92 PID 3272 wrote to memory of 3888 3272 417D.tmp 92 PID 3888 wrote to memory of 4628 3888 41FA.tmp 93 PID 3888 wrote to memory of 4628 3888 41FA.tmp 93 PID 3888 wrote to memory of 4628 3888 41FA.tmp 93 PID 4628 wrote to memory of 1832 4628 4268.tmp 94 PID 4628 wrote to memory of 1832 4628 4268.tmp 94 PID 4628 wrote to memory of 1832 4628 4268.tmp 94 PID 1832 wrote to memory of 408 1832 42E5.tmp 95 PID 1832 wrote to memory of 408 1832 42E5.tmp 95 PID 1832 wrote to memory of 408 1832 42E5.tmp 95 PID 408 wrote to memory of 4264 408 4362.tmp 96 PID 408 wrote to memory of 4264 408 4362.tmp 96 PID 408 wrote to memory of 4264 408 4362.tmp 96 PID 4264 wrote to memory of 924 4264 440E.tmp 97 PID 4264 wrote to memory of 924 4264 440E.tmp 97 PID 4264 wrote to memory of 924 4264 440E.tmp 97 PID 924 wrote to memory of 2632 924 448B.tmp 98 PID 924 wrote to memory of 2632 924 448B.tmp 98 PID 924 wrote to memory of 2632 924 448B.tmp 98 PID 2632 wrote to memory of 4752 2632 4527.tmp 99 PID 2632 wrote to memory of 4752 2632 4527.tmp 99 PID 2632 wrote to memory of 4752 2632 4527.tmp 99 PID 4752 wrote to memory of 1544 4752 4594.tmp 100 PID 4752 wrote to memory of 1544 4752 4594.tmp 100 PID 4752 wrote to memory of 1544 4752 4594.tmp 100 PID 1544 wrote to memory of 4608 1544 4621.tmp 101 PID 1544 wrote to memory of 4608 1544 4621.tmp 101 PID 1544 wrote to memory of 4608 1544 4621.tmp 101 PID 4608 wrote to memory of 3336 4608 468E.tmp 102 PID 4608 wrote to memory of 3336 4608 468E.tmp 102 PID 4608 wrote to memory of 3336 4608 468E.tmp 102 PID 3336 wrote to memory of 4656 3336 46FC.tmp 103 PID 3336 wrote to memory of 4656 3336 46FC.tmp 103 PID 3336 wrote to memory of 4656 3336 46FC.tmp 103 PID 4656 wrote to memory of 2760 4656 4779.tmp 104 PID 4656 wrote to memory of 2760 4656 4779.tmp 104 PID 4656 wrote to memory of 2760 4656 4779.tmp 104 PID 2760 wrote to memory of 852 2760 4805.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_73b0ae4b7b131353b1509579ff726f92_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"23⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"24⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"25⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"26⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"27⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"28⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"29⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"30⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"31⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"32⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"33⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"34⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"35⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"36⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"37⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"38⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"39⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"40⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"41⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"42⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"43⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"44⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"45⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"46⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"47⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"48⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"49⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"50⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"51⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"52⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"53⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"54⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"55⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"56⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"57⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"58⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"59⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"60⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"61⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"62⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"63⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"64⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"65⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"66⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"67⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"68⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"69⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"70⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"71⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"72⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"73⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"74⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"75⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"76⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"77⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"79⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"80⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"81⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"82⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"83⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"84⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"85⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"86⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"87⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"88⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"89⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"90⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"91⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"92⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"93⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"94⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"95⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"96⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"97⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"99⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"100⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"101⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"102⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"103⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"104⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"105⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"106⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"107⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"108⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"109⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"110⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"111⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"112⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"113⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"114⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"115⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"116⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"117⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"118⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"119⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"120⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"122⤵PID:4576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-