Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe
-
Size
486KB
-
MD5
f8fa7935d9f1d2e9857d0c44d249d0e5
-
SHA1
bad54398b1d6c00c1b753c97fa25f8e0a05657ec
-
SHA256
58dec60807517da70a14e98f55229bbd03dfb8f4c39d27658f0bff95832f0aa2
-
SHA512
fb9ce2296d9db877d14a9b1aff9c41807120bfc6a853108b9298a70217abc3447fa583a33819f52c6eaf165ab18e44851b086b8bfdd83e910e572ad90dadceb3
-
SSDEEP
12288:/U5rCOTeiDFchbmv0kidKZmYBvS/6woWc2eNZ:/UQOJDFcJUyKkmC6woWbeN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4968 51F8.tmp 4548 5285.tmp 2848 5331.tmp 4936 53CD.tmp 3220 5479.tmp 1388 5525.tmp 1504 55C1.tmp 2612 562E.tmp 1572 568C.tmp 3020 5719.tmp 1016 5796.tmp 1448 5822.tmp 4736 58CE.tmp 3260 592C.tmp 3976 5999.tmp 3340 5A26.tmp 2516 5AA3.tmp 1944 5B4F.tmp 4392 5BEB.tmp 4772 5C87.tmp 1468 5D24.tmp 572 5DB0.tmp 392 5E2D.tmp 5100 5EBA.tmp 4864 5F27.tmp 1380 5FC3.tmp 4784 6040.tmp 2924 608F.tmp 2396 6189.tmp 648 6206.tmp 4956 6283.tmp 3112 632E.tmp 3364 638C.tmp 916 63EA.tmp 3084 6438.tmp 2812 6496.tmp 4128 64F4.tmp 3892 6551.tmp 4624 65AF.tmp 2888 65FD.tmp 2768 664B.tmp 1868 66A9.tmp 2364 6707.tmp 208 6755.tmp 4388 67C2.tmp 2232 6820.tmp 3200 687E.tmp 3792 68DC.tmp 220 692A.tmp 3168 6987.tmp 3172 69F5.tmp 1144 6A43.tmp 444 6AA1.tmp 3496 6AEF.tmp 864 6B3D.tmp 4512 6BAA.tmp 4316 6C08.tmp 3216 6C56.tmp 4968 6CA4.tmp 3080 6CF2.tmp 4976 6D50.tmp 4556 6DAE.tmp 2568 6E1B.tmp 4360 6E89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4968 4800 2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe 84 PID 4800 wrote to memory of 4968 4800 2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe 84 PID 4800 wrote to memory of 4968 4800 2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe 84 PID 4968 wrote to memory of 4548 4968 51F8.tmp 85 PID 4968 wrote to memory of 4548 4968 51F8.tmp 85 PID 4968 wrote to memory of 4548 4968 51F8.tmp 85 PID 4548 wrote to memory of 2848 4548 5285.tmp 86 PID 4548 wrote to memory of 2848 4548 5285.tmp 86 PID 4548 wrote to memory of 2848 4548 5285.tmp 86 PID 2848 wrote to memory of 4936 2848 5331.tmp 87 PID 2848 wrote to memory of 4936 2848 5331.tmp 87 PID 2848 wrote to memory of 4936 2848 5331.tmp 87 PID 4936 wrote to memory of 3220 4936 53CD.tmp 88 PID 4936 wrote to memory of 3220 4936 53CD.tmp 88 PID 4936 wrote to memory of 3220 4936 53CD.tmp 88 PID 3220 wrote to memory of 1388 3220 5479.tmp 89 PID 3220 wrote to memory of 1388 3220 5479.tmp 89 PID 3220 wrote to memory of 1388 3220 5479.tmp 89 PID 1388 wrote to memory of 1504 1388 5525.tmp 90 PID 1388 wrote to memory of 1504 1388 5525.tmp 90 PID 1388 wrote to memory of 1504 1388 5525.tmp 90 PID 1504 wrote to memory of 2612 1504 55C1.tmp 91 PID 1504 wrote to memory of 2612 1504 55C1.tmp 91 PID 1504 wrote to memory of 2612 1504 55C1.tmp 91 PID 2612 wrote to memory of 1572 2612 562E.tmp 92 PID 2612 wrote to memory of 1572 2612 562E.tmp 92 PID 2612 wrote to memory of 1572 2612 562E.tmp 92 PID 1572 wrote to memory of 3020 1572 568C.tmp 93 PID 1572 wrote to memory of 3020 1572 568C.tmp 93 PID 1572 wrote to memory of 3020 1572 568C.tmp 93 PID 3020 wrote to memory of 1016 3020 5719.tmp 94 PID 3020 wrote to memory of 1016 3020 5719.tmp 94 PID 3020 wrote to memory of 1016 3020 5719.tmp 94 PID 1016 wrote to memory of 1448 1016 5796.tmp 95 PID 1016 wrote to memory of 1448 1016 5796.tmp 95 PID 1016 wrote to memory of 1448 1016 5796.tmp 95 PID 1448 wrote to memory of 4736 1448 5822.tmp 96 PID 1448 wrote to memory of 4736 1448 5822.tmp 96 PID 1448 wrote to memory of 4736 1448 5822.tmp 96 PID 4736 wrote to memory of 3260 4736 58CE.tmp 97 PID 4736 wrote to memory of 3260 4736 58CE.tmp 97 PID 4736 wrote to memory of 3260 4736 58CE.tmp 97 PID 3260 wrote to memory of 3976 3260 592C.tmp 98 PID 3260 wrote to memory of 3976 3260 592C.tmp 98 PID 3260 wrote to memory of 3976 3260 592C.tmp 98 PID 3976 wrote to memory of 3340 3976 5999.tmp 99 PID 3976 wrote to memory of 3340 3976 5999.tmp 99 PID 3976 wrote to memory of 3340 3976 5999.tmp 99 PID 3340 wrote to memory of 2516 3340 5A26.tmp 100 PID 3340 wrote to memory of 2516 3340 5A26.tmp 100 PID 3340 wrote to memory of 2516 3340 5A26.tmp 100 PID 2516 wrote to memory of 1944 2516 5AA3.tmp 101 PID 2516 wrote to memory of 1944 2516 5AA3.tmp 101 PID 2516 wrote to memory of 1944 2516 5AA3.tmp 101 PID 1944 wrote to memory of 4392 1944 5B4F.tmp 102 PID 1944 wrote to memory of 4392 1944 5B4F.tmp 102 PID 1944 wrote to memory of 4392 1944 5B4F.tmp 102 PID 4392 wrote to memory of 4772 4392 5BEB.tmp 103 PID 4392 wrote to memory of 4772 4392 5BEB.tmp 103 PID 4392 wrote to memory of 4772 4392 5BEB.tmp 103 PID 4772 wrote to memory of 1468 4772 5C87.tmp 104 PID 4772 wrote to memory of 1468 4772 5C87.tmp 104 PID 4772 wrote to memory of 1468 4772 5C87.tmp 104 PID 1468 wrote to memory of 572 1468 5D24.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_f8fa7935d9f1d2e9857d0c44d249d0e5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"23⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"24⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"25⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"26⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"27⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"28⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"29⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"30⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"31⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"32⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"33⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"34⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"35⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"36⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"37⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"38⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"39⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"40⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"41⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"42⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"43⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"44⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"45⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"46⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"47⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"48⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"49⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"50⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"51⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"52⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"53⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"54⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"55⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"56⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"57⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"58⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"59⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"60⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"61⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"62⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"63⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"64⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"65⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"66⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"67⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"68⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"69⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"70⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"71⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"72⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"73⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"74⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"75⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"76⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"77⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"78⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"79⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"80⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"81⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"82⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"83⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"84⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"85⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"86⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"87⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"88⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"89⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"90⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"91⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"92⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"93⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"94⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"96⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"97⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"98⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"99⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"100⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"102⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"103⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"104⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"105⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"106⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"107⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"108⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"110⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"111⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"112⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"113⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"114⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"115⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"117⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"118⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"119⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"120⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"121⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-