Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe
-
Size
486KB
-
MD5
69e41125e70c0b6c560e59e21f783171
-
SHA1
ed1662357453bba104f4d5a89416a24b9c25491c
-
SHA256
7e817e0cec35e63f66c6e33322525d03b9042015fc5f5a69151e6373d774d64e
-
SHA512
4b5b2a629890edbbf5e9eff2999f8c2ba64e4d7740d4dcba20e919d1315b8217a67d29ebebdfded923bd78b615163d46b5f30c665a9b2d1c567256400c2f632a
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJ7DACniFzKF4+IZdUjAFbrWexSISbZ664/ITP:/U5rCOTeiDJAeXI6A5rWSSIC4qyqh0j
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2452 3587.tmp 512 3614.tmp 1612 3671.tmp 4524 36DF.tmp 4956 373C.tmp 2804 379A.tmp 4860 37E8.tmp 4020 3856.tmp 4492 38A4.tmp 632 3911.tmp 396 395F.tmp 4712 39CD.tmp 4772 3A3A.tmp 4676 3A98.tmp 2440 3AE6.tmp 404 3B73.tmp 3064 3BE0.tmp 392 3C4D.tmp 1728 3CAB.tmp 2280 3D38.tmp 1312 3D95.tmp 4984 3DF3.tmp 468 3E51.tmp 5044 3E9F.tmp 3880 3EED.tmp 4256 3F4B.tmp 2944 3F99.tmp 3796 3FF7.tmp 2132 4055.tmp 376 40A3.tmp 3672 40F1.tmp 4080 413F.tmp 4584 419D.tmp 4312 41EB.tmp 4536 4239.tmp 220 4287.tmp 464 42D5.tmp 4292 4323.tmp 3972 4371.tmp 3204 43C0.tmp 1116 440E.tmp 380 445C.tmp 1076 44AA.tmp 4428 44F8.tmp 4700 4556.tmp 232 45A4.tmp 844 45F2.tmp 1964 4640.tmp 2432 469E.tmp 64 46EC.tmp 5036 473A.tmp 3484 4798.tmp 3808 47E6.tmp 2372 4834.tmp 648 4882.tmp 2512 48D0.tmp 2244 491F.tmp 552 496D.tmp 884 49BB.tmp 640 4A19.tmp 3064 4A86.tmp 4140 4B22.tmp 3588 4B80.tmp 2916 4BCE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3248 wrote to memory of 2452 3248 2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe 86 PID 3248 wrote to memory of 2452 3248 2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe 86 PID 3248 wrote to memory of 2452 3248 2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe 86 PID 2452 wrote to memory of 512 2452 3587.tmp 87 PID 2452 wrote to memory of 512 2452 3587.tmp 87 PID 2452 wrote to memory of 512 2452 3587.tmp 87 PID 512 wrote to memory of 1612 512 3614.tmp 88 PID 512 wrote to memory of 1612 512 3614.tmp 88 PID 512 wrote to memory of 1612 512 3614.tmp 88 PID 1612 wrote to memory of 4524 1612 3671.tmp 89 PID 1612 wrote to memory of 4524 1612 3671.tmp 89 PID 1612 wrote to memory of 4524 1612 3671.tmp 89 PID 4524 wrote to memory of 4956 4524 36DF.tmp 91 PID 4524 wrote to memory of 4956 4524 36DF.tmp 91 PID 4524 wrote to memory of 4956 4524 36DF.tmp 91 PID 4956 wrote to memory of 2804 4956 373C.tmp 94 PID 4956 wrote to memory of 2804 4956 373C.tmp 94 PID 4956 wrote to memory of 2804 4956 373C.tmp 94 PID 2804 wrote to memory of 4860 2804 379A.tmp 95 PID 2804 wrote to memory of 4860 2804 379A.tmp 95 PID 2804 wrote to memory of 4860 2804 379A.tmp 95 PID 4860 wrote to memory of 4020 4860 37E8.tmp 96 PID 4860 wrote to memory of 4020 4860 37E8.tmp 96 PID 4860 wrote to memory of 4020 4860 37E8.tmp 96 PID 4020 wrote to memory of 4492 4020 3856.tmp 97 PID 4020 wrote to memory of 4492 4020 3856.tmp 97 PID 4020 wrote to memory of 4492 4020 3856.tmp 97 PID 4492 wrote to memory of 632 4492 38A4.tmp 98 PID 4492 wrote to memory of 632 4492 38A4.tmp 98 PID 4492 wrote to memory of 632 4492 38A4.tmp 98 PID 632 wrote to memory of 396 632 3911.tmp 99 PID 632 wrote to memory of 396 632 3911.tmp 99 PID 632 wrote to memory of 396 632 3911.tmp 99 PID 396 wrote to memory of 4712 396 395F.tmp 100 PID 396 wrote to memory of 4712 396 395F.tmp 100 PID 396 wrote to memory of 4712 396 395F.tmp 100 PID 4712 wrote to memory of 4772 4712 39CD.tmp 101 PID 4712 wrote to memory of 4772 4712 39CD.tmp 101 PID 4712 wrote to memory of 4772 4712 39CD.tmp 101 PID 4772 wrote to memory of 4676 4772 3A3A.tmp 102 PID 4772 wrote to memory of 4676 4772 3A3A.tmp 102 PID 4772 wrote to memory of 4676 4772 3A3A.tmp 102 PID 4676 wrote to memory of 2440 4676 3A98.tmp 104 PID 4676 wrote to memory of 2440 4676 3A98.tmp 104 PID 4676 wrote to memory of 2440 4676 3A98.tmp 104 PID 2440 wrote to memory of 404 2440 3AE6.tmp 105 PID 2440 wrote to memory of 404 2440 3AE6.tmp 105 PID 2440 wrote to memory of 404 2440 3AE6.tmp 105 PID 404 wrote to memory of 3064 404 3B73.tmp 106 PID 404 wrote to memory of 3064 404 3B73.tmp 106 PID 404 wrote to memory of 3064 404 3B73.tmp 106 PID 3064 wrote to memory of 392 3064 3BE0.tmp 107 PID 3064 wrote to memory of 392 3064 3BE0.tmp 107 PID 3064 wrote to memory of 392 3064 3BE0.tmp 107 PID 392 wrote to memory of 1728 392 3C4D.tmp 108 PID 392 wrote to memory of 1728 392 3C4D.tmp 108 PID 392 wrote to memory of 1728 392 3C4D.tmp 108 PID 1728 wrote to memory of 2280 1728 3CAB.tmp 109 PID 1728 wrote to memory of 2280 1728 3CAB.tmp 109 PID 1728 wrote to memory of 2280 1728 3CAB.tmp 109 PID 2280 wrote to memory of 1312 2280 3D38.tmp 110 PID 2280 wrote to memory of 1312 2280 3D38.tmp 110 PID 2280 wrote to memory of 1312 2280 3D38.tmp 110 PID 1312 wrote to memory of 4984 1312 3D95.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_69e41125e70c0b6c560e59e21f783171_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3614.tmp"C:\Users\Admin\AppData\Local\Temp\3614.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\37E8.tmp"C:\Users\Admin\AppData\Local\Temp\37E8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"23⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"24⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"25⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"26⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"27⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"28⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"29⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"30⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"31⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"32⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"33⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"34⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"35⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"36⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"37⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"38⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"39⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"40⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"41⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"42⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"43⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"44⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"45⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"46⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"47⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"48⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"49⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"50⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"51⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"52⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"53⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"54⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"55⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"56⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"57⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"58⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"59⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"60⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"61⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"62⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"63⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"64⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"65⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"66⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"67⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"69⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"70⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"71⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"72⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"73⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"74⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"75⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"76⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"77⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"78⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"79⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"80⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"81⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"82⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"83⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"84⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"85⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"86⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"87⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"88⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"89⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"90⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"91⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"92⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"93⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"94⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"95⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"96⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"97⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"99⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"100⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"101⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"102⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"103⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"104⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"105⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"106⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"107⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"108⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"109⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"110⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"111⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"112⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"114⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"115⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"117⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"118⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"119⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"120⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"121⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"122⤵PID:3312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-