Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe
-
Size
488KB
-
MD5
d617fe2fa4f4026081d92e63da181c22
-
SHA1
da6c1201f574abc5eac837a6b4eac2a6357f33df
-
SHA256
198b1e3205d0a6e4e14b5c915a2d77a810e4fa19c9284c1088575270ea1dbe4a
-
SHA512
1edc05bcd5d8ba7ac3bafcbaa3a4fbe6c40447677885a7b68956ac50c6a7b9cf7dd993a461d6b5e2d1de17c29acf1cf5cd610fd7d366148a05661aaa49c44bda
-
SSDEEP
12288:/U5rCOTeiDwvc+iz2uspRAkeFVdTfhOObNZ:/UQOJDkizBspRAkSVdTfUwN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3928 4239.tmp 1808 42A6.tmp 1008 4323.tmp 4884 43B0.tmp 1508 441D.tmp 1964 447B.tmp 640 44D9.tmp 2216 4537.tmp 4892 4585.tmp 3236 45E2.tmp 4996 4640.tmp 1268 46AE.tmp 392 470B.tmp 1316 4788.tmp 4896 47E6.tmp 5092 4853.tmp 4956 48A2.tmp 1904 48F0.tmp 2220 493E.tmp 4552 499C.tmp 3588 49F9.tmp 4864 4A47.tmp 1592 4AA5.tmp 3760 4AF3.tmp 992 4B70.tmp 3660 4BDE.tmp 4820 4C4B.tmp 4024 4CB8.tmp 3432 4D26.tmp 4944 4D84.tmp 3556 4E10.tmp 3804 4E6E.tmp 2520 4EEB.tmp 2460 4F49.tmp 4164 4FA6.tmp 1528 4FF5.tmp 2548 5043.tmp 1896 5091.tmp 2184 50DF.tmp 4932 513D.tmp 2396 519A.tmp 3364 51F8.tmp 2988 5246.tmp 5104 5294.tmp 2628 52E3.tmp 1508 5340.tmp 1640 539E.tmp 4988 53EC.tmp 3516 544A.tmp 2836 54A8.tmp 1416 5505.tmp 1792 5554.tmp 3236 55B1.tmp 4996 560F.tmp 3704 566D.tmp 1268 56BB.tmp 2848 5709.tmp 4408 5767.tmp 4800 57B5.tmp 2856 5813.tmp 724 5870.tmp 5040 58CE.tmp 916 592C.tmp 1904 597A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 3928 940 2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe 85 PID 940 wrote to memory of 3928 940 2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe 85 PID 940 wrote to memory of 3928 940 2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe 85 PID 3928 wrote to memory of 1808 3928 4239.tmp 87 PID 3928 wrote to memory of 1808 3928 4239.tmp 87 PID 3928 wrote to memory of 1808 3928 4239.tmp 87 PID 1808 wrote to memory of 1008 1808 42A6.tmp 88 PID 1808 wrote to memory of 1008 1808 42A6.tmp 88 PID 1808 wrote to memory of 1008 1808 42A6.tmp 88 PID 1008 wrote to memory of 4884 1008 4323.tmp 91 PID 1008 wrote to memory of 4884 1008 4323.tmp 91 PID 1008 wrote to memory of 4884 1008 4323.tmp 91 PID 4884 wrote to memory of 1508 4884 43B0.tmp 92 PID 4884 wrote to memory of 1508 4884 43B0.tmp 92 PID 4884 wrote to memory of 1508 4884 43B0.tmp 92 PID 1508 wrote to memory of 1964 1508 441D.tmp 93 PID 1508 wrote to memory of 1964 1508 441D.tmp 93 PID 1508 wrote to memory of 1964 1508 441D.tmp 93 PID 1964 wrote to memory of 640 1964 447B.tmp 94 PID 1964 wrote to memory of 640 1964 447B.tmp 94 PID 1964 wrote to memory of 640 1964 447B.tmp 94 PID 640 wrote to memory of 2216 640 44D9.tmp 95 PID 640 wrote to memory of 2216 640 44D9.tmp 95 PID 640 wrote to memory of 2216 640 44D9.tmp 95 PID 2216 wrote to memory of 4892 2216 4537.tmp 96 PID 2216 wrote to memory of 4892 2216 4537.tmp 96 PID 2216 wrote to memory of 4892 2216 4537.tmp 96 PID 4892 wrote to memory of 3236 4892 4585.tmp 97 PID 4892 wrote to memory of 3236 4892 4585.tmp 97 PID 4892 wrote to memory of 3236 4892 4585.tmp 97 PID 3236 wrote to memory of 4996 3236 45E2.tmp 98 PID 3236 wrote to memory of 4996 3236 45E2.tmp 98 PID 3236 wrote to memory of 4996 3236 45E2.tmp 98 PID 4996 wrote to memory of 1268 4996 4640.tmp 99 PID 4996 wrote to memory of 1268 4996 4640.tmp 99 PID 4996 wrote to memory of 1268 4996 4640.tmp 99 PID 1268 wrote to memory of 392 1268 46AE.tmp 100 PID 1268 wrote to memory of 392 1268 46AE.tmp 100 PID 1268 wrote to memory of 392 1268 46AE.tmp 100 PID 392 wrote to memory of 1316 392 470B.tmp 101 PID 392 wrote to memory of 1316 392 470B.tmp 101 PID 392 wrote to memory of 1316 392 470B.tmp 101 PID 1316 wrote to memory of 4896 1316 4788.tmp 102 PID 1316 wrote to memory of 4896 1316 4788.tmp 102 PID 1316 wrote to memory of 4896 1316 4788.tmp 102 PID 4896 wrote to memory of 5092 4896 47E6.tmp 103 PID 4896 wrote to memory of 5092 4896 47E6.tmp 103 PID 4896 wrote to memory of 5092 4896 47E6.tmp 103 PID 5092 wrote to memory of 4956 5092 4853.tmp 104 PID 5092 wrote to memory of 4956 5092 4853.tmp 104 PID 5092 wrote to memory of 4956 5092 4853.tmp 104 PID 4956 wrote to memory of 1904 4956 48A2.tmp 105 PID 4956 wrote to memory of 1904 4956 48A2.tmp 105 PID 4956 wrote to memory of 1904 4956 48A2.tmp 105 PID 1904 wrote to memory of 2220 1904 48F0.tmp 106 PID 1904 wrote to memory of 2220 1904 48F0.tmp 106 PID 1904 wrote to memory of 2220 1904 48F0.tmp 106 PID 2220 wrote to memory of 4552 2220 493E.tmp 107 PID 2220 wrote to memory of 4552 2220 493E.tmp 107 PID 2220 wrote to memory of 4552 2220 493E.tmp 107 PID 4552 wrote to memory of 3588 4552 499C.tmp 109 PID 4552 wrote to memory of 3588 4552 499C.tmp 109 PID 4552 wrote to memory of 3588 4552 499C.tmp 109 PID 3588 wrote to memory of 4864 3588 49F9.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_d617fe2fa4f4026081d92e63da181c22_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"23⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"24⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"25⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"26⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"27⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"28⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"29⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"30⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"31⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"32⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"33⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"34⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"35⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"36⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"37⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"38⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"39⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"40⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"41⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"42⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"43⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"44⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"45⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"46⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"47⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"48⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"49⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"50⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"51⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"52⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"53⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"54⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"55⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"56⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"57⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"58⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"59⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"60⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"61⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"62⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"63⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"64⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"65⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"66⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"67⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"68⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"69⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"70⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"71⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"72⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"73⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"74⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"75⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"76⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"77⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"78⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"79⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"80⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"81⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"82⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"83⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"84⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"85⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"86⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"87⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"88⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"89⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"90⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"91⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"92⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"93⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"95⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"96⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"97⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"98⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"99⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"100⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"101⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"102⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"103⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"104⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"105⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"106⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"107⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"108⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"109⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"110⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"111⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"112⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"113⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"114⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"115⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"116⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"117⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"118⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"119⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"120⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"121⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-