Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 05:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe
-
Size
541KB
-
MD5
a343c31cc89a2649c69d08d0fb5d9b09
-
SHA1
829e536ea97a365d0f1167aa79e845b5a4beec7d
-
SHA256
d20b7134a0c9162e8436a88da60803ea07b424b479d20eceec9b75fecb7b1648
-
SHA512
3f04b55dec0c816d9ac1e96c6e0f4fe29c6f1e1c316d32bf45f34ae146c1f27d1861461ce290709098cdf02378927fe503956535b127c25341f81cf7acfd2e80
-
SSDEEP
12288:UU5rCOTeif570wQ6WO9RYST+SX0RzbrZa73ctO:UUQOJf570wpW6xX0RzbrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2856 33C2.tmp 2748 342F.tmp 2064 348D.tmp 4036 3529.tmp 5108 35B6.tmp 1396 3633.tmp 4696 36A0.tmp 1200 36FE.tmp 5116 375C.tmp 4864 37D9.tmp 4880 3836.tmp 2732 38B3.tmp 388 3930.tmp 4160 399E.tmp 4436 3A2A.tmp 1416 3A98.tmp 4960 3B15.tmp 4644 3B73.tmp 3980 3BF0.tmp 1240 3C4D.tmp 2172 3CDA.tmp 4876 3D47.tmp 3308 3DB5.tmp 2716 3E32.tmp 2436 3EDE.tmp 3568 3F6A.tmp 2312 3FF7.tmp 3436 40A3.tmp 2980 4100.tmp 3340 416E.tmp 2700 41DB.tmp 4272 4258.tmp 2000 42B6.tmp 4944 4314.tmp 4740 4362.tmp 4412 43C0.tmp 548 440E.tmp 4056 446B.tmp 3596 44C9.tmp 4304 4517.tmp 3724 4575.tmp 4448 45F2.tmp 592 4650.tmp 1352 469E.tmp 4180 46FC.tmp 1384 4769.tmp 4292 47C7.tmp 4468 4825.tmp 2432 4882.tmp 2876 48E0.tmp 736 493E.tmp 2456 498C.tmp 1608 49EA.tmp 4588 4A57.tmp 3560 4AB5.tmp 788 4B13.tmp 3172 4B61.tmp 3924 4BAF.tmp 376 4C0D.tmp 4236 4C6A.tmp 5076 4CC8.tmp 1980 4D16.tmp 3200 4D74.tmp 2716 4DD2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2856 2036 2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe 88 PID 2036 wrote to memory of 2856 2036 2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe 88 PID 2036 wrote to memory of 2856 2036 2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe 88 PID 2856 wrote to memory of 2748 2856 33C2.tmp 89 PID 2856 wrote to memory of 2748 2856 33C2.tmp 89 PID 2856 wrote to memory of 2748 2856 33C2.tmp 89 PID 2748 wrote to memory of 2064 2748 342F.tmp 91 PID 2748 wrote to memory of 2064 2748 342F.tmp 91 PID 2748 wrote to memory of 2064 2748 342F.tmp 91 PID 2064 wrote to memory of 4036 2064 348D.tmp 92 PID 2064 wrote to memory of 4036 2064 348D.tmp 92 PID 2064 wrote to memory of 4036 2064 348D.tmp 92 PID 4036 wrote to memory of 5108 4036 3529.tmp 93 PID 4036 wrote to memory of 5108 4036 3529.tmp 93 PID 4036 wrote to memory of 5108 4036 3529.tmp 93 PID 5108 wrote to memory of 1396 5108 35B6.tmp 95 PID 5108 wrote to memory of 1396 5108 35B6.tmp 95 PID 5108 wrote to memory of 1396 5108 35B6.tmp 95 PID 1396 wrote to memory of 4696 1396 3633.tmp 97 PID 1396 wrote to memory of 4696 1396 3633.tmp 97 PID 1396 wrote to memory of 4696 1396 3633.tmp 97 PID 4696 wrote to memory of 1200 4696 36A0.tmp 98 PID 4696 wrote to memory of 1200 4696 36A0.tmp 98 PID 4696 wrote to memory of 1200 4696 36A0.tmp 98 PID 1200 wrote to memory of 5116 1200 36FE.tmp 99 PID 1200 wrote to memory of 5116 1200 36FE.tmp 99 PID 1200 wrote to memory of 5116 1200 36FE.tmp 99 PID 5116 wrote to memory of 4864 5116 375C.tmp 100 PID 5116 wrote to memory of 4864 5116 375C.tmp 100 PID 5116 wrote to memory of 4864 5116 375C.tmp 100 PID 4864 wrote to memory of 4880 4864 37D9.tmp 101 PID 4864 wrote to memory of 4880 4864 37D9.tmp 101 PID 4864 wrote to memory of 4880 4864 37D9.tmp 101 PID 4880 wrote to memory of 2732 4880 3836.tmp 102 PID 4880 wrote to memory of 2732 4880 3836.tmp 102 PID 4880 wrote to memory of 2732 4880 3836.tmp 102 PID 2732 wrote to memory of 388 2732 38B3.tmp 103 PID 2732 wrote to memory of 388 2732 38B3.tmp 103 PID 2732 wrote to memory of 388 2732 38B3.tmp 103 PID 388 wrote to memory of 4160 388 3930.tmp 104 PID 388 wrote to memory of 4160 388 3930.tmp 104 PID 388 wrote to memory of 4160 388 3930.tmp 104 PID 4160 wrote to memory of 4436 4160 399E.tmp 105 PID 4160 wrote to memory of 4436 4160 399E.tmp 105 PID 4160 wrote to memory of 4436 4160 399E.tmp 105 PID 4436 wrote to memory of 1416 4436 3A2A.tmp 106 PID 4436 wrote to memory of 1416 4436 3A2A.tmp 106 PID 4436 wrote to memory of 1416 4436 3A2A.tmp 106 PID 1416 wrote to memory of 4960 1416 3A98.tmp 107 PID 1416 wrote to memory of 4960 1416 3A98.tmp 107 PID 1416 wrote to memory of 4960 1416 3A98.tmp 107 PID 4960 wrote to memory of 4644 4960 3B15.tmp 108 PID 4960 wrote to memory of 4644 4960 3B15.tmp 108 PID 4960 wrote to memory of 4644 4960 3B15.tmp 108 PID 4644 wrote to memory of 3980 4644 3B73.tmp 109 PID 4644 wrote to memory of 3980 4644 3B73.tmp 109 PID 4644 wrote to memory of 3980 4644 3B73.tmp 109 PID 3980 wrote to memory of 1240 3980 3BF0.tmp 110 PID 3980 wrote to memory of 1240 3980 3BF0.tmp 110 PID 3980 wrote to memory of 1240 3980 3BF0.tmp 110 PID 1240 wrote to memory of 2172 1240 3C4D.tmp 111 PID 1240 wrote to memory of 2172 1240 3C4D.tmp 111 PID 1240 wrote to memory of 2172 1240 3C4D.tmp 111 PID 2172 wrote to memory of 4876 2172 3CDA.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_a343c31cc89a2649c69d08d0fb5d9b09_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3930.tmp"C:\Users\Admin\AppData\Local\Temp\3930.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"23⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"24⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"25⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"26⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"27⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"28⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"29⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"30⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"31⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"32⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"33⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"34⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"35⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"36⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"37⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"38⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"39⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"40⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"41⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"42⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"43⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"44⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"45⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"46⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"47⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"48⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"49⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"50⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"51⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"52⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"53⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"54⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"55⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"56⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"57⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"58⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"59⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"60⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"61⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"62⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"63⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"64⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"65⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"66⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"67⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"68⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"69⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"70⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"71⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"72⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"73⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"74⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"75⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"76⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"77⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"78⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"79⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"80⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"81⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"82⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"83⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"84⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"85⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"86⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"87⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"88⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"89⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"90⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"91⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"92⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"93⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"94⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"95⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"96⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"97⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"98⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"99⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"100⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"101⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"102⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"103⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"104⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"105⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"106⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"107⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"108⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"109⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"110⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"111⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"112⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"113⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"114⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"115⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"116⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"117⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"119⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"120⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"121⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"122⤵PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-