Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
-
Size
530KB
-
MD5
34deb4af77eee62ef4f6aea753e73ed7
-
SHA1
36e8ede9fe09c67a367472e469b6db4fd13a40b5
-
SHA256
6fb0082f3e8435148b8fcc2c4ba97a17ae3a79888682285a043a4489bf3f084b
-
SHA512
b411db82bb5541fb336f79e3abc8d8e540444c4f097cf2ee06326e102ea6c37c2a868f0edc85516d320c6a6c8a0db2a5955ae4d40ed0ca85ed8dbb77703e4218
-
SSDEEP
12288:AU5rCOTeiorddBWFJIRdUpQBa+TVg2l2wdNZulFVg0M1:AUQOJoRS4RdUpQBauVTQQNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4292 68CC.tmp 4024 6949.tmp 4728 69B6.tmp 1236 6A43.tmp 4044 6AA1.tmp 2452 6AFE.tmp 4008 6B4D.tmp 4736 6BCA.tmp 2708 6C47.tmp 4576 6CB4.tmp 2796 6D12.tmp 3004 6D8F.tmp 5108 6DFC.tmp 4060 6E4A.tmp 872 6E98.tmp 4756 6EE6.tmp 4804 6F44.tmp 4608 6FA2.tmp 3140 700F.tmp 2992 708C.tmp 3284 70FA.tmp 3012 7157.tmp 4472 71B5.tmp 2280 7213.tmp 4920 7261.tmp 4572 72AF.tmp 2424 72FD.tmp 4900 735B.tmp 2936 73A9.tmp 2584 7407.tmp 4368 7455.tmp 3928 74C2.tmp 4580 7520.tmp 4128 756E.tmp 2304 75BC.tmp 4116 760B.tmp 2848 7659.tmp 1596 76B6.tmp 5008 7705.tmp 1940 7753.tmp 64 77A1.tmp 2912 77FF.tmp 3624 784D.tmp 4816 78AA.tmp 1500 78F9.tmp 4632 7947.tmp 2996 79A4.tmp 4340 7A02.tmp 1928 7A60.tmp 4432 7AAE.tmp 388 7B0C.tmp 1884 7B6A.tmp 4552 7BC7.tmp 3916 7C25.tmp 4968 7C83.tmp 3024 7CD1.tmp 4884 7D1F.tmp 4752 7D6D.tmp 1332 7DBB.tmp 4480 7E09.tmp 1552 7E58.tmp 4792 7EA6.tmp 5080 7F03.tmp 5084 7F61.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3588 wrote to memory of 4292 3588 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 89 PID 3588 wrote to memory of 4292 3588 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 89 PID 3588 wrote to memory of 4292 3588 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 89 PID 4292 wrote to memory of 4024 4292 68CC.tmp 90 PID 4292 wrote to memory of 4024 4292 68CC.tmp 90 PID 4292 wrote to memory of 4024 4292 68CC.tmp 90 PID 4024 wrote to memory of 4728 4024 6949.tmp 92 PID 4024 wrote to memory of 4728 4024 6949.tmp 92 PID 4024 wrote to memory of 4728 4024 6949.tmp 92 PID 4728 wrote to memory of 1236 4728 69B6.tmp 94 PID 4728 wrote to memory of 1236 4728 69B6.tmp 94 PID 4728 wrote to memory of 1236 4728 69B6.tmp 94 PID 1236 wrote to memory of 4044 1236 6A43.tmp 96 PID 1236 wrote to memory of 4044 1236 6A43.tmp 96 PID 1236 wrote to memory of 4044 1236 6A43.tmp 96 PID 4044 wrote to memory of 2452 4044 6AA1.tmp 97 PID 4044 wrote to memory of 2452 4044 6AA1.tmp 97 PID 4044 wrote to memory of 2452 4044 6AA1.tmp 97 PID 2452 wrote to memory of 4008 2452 6AFE.tmp 98 PID 2452 wrote to memory of 4008 2452 6AFE.tmp 98 PID 2452 wrote to memory of 4008 2452 6AFE.tmp 98 PID 4008 wrote to memory of 4736 4008 6B4D.tmp 99 PID 4008 wrote to memory of 4736 4008 6B4D.tmp 99 PID 4008 wrote to memory of 4736 4008 6B4D.tmp 99 PID 4736 wrote to memory of 2708 4736 6BCA.tmp 100 PID 4736 wrote to memory of 2708 4736 6BCA.tmp 100 PID 4736 wrote to memory of 2708 4736 6BCA.tmp 100 PID 2708 wrote to memory of 4576 2708 6C47.tmp 101 PID 2708 wrote to memory of 4576 2708 6C47.tmp 101 PID 2708 wrote to memory of 4576 2708 6C47.tmp 101 PID 4576 wrote to memory of 2796 4576 6CB4.tmp 102 PID 4576 wrote to memory of 2796 4576 6CB4.tmp 102 PID 4576 wrote to memory of 2796 4576 6CB4.tmp 102 PID 2796 wrote to memory of 3004 2796 6D12.tmp 103 PID 2796 wrote to memory of 3004 2796 6D12.tmp 103 PID 2796 wrote to memory of 3004 2796 6D12.tmp 103 PID 3004 wrote to memory of 5108 3004 6D8F.tmp 104 PID 3004 wrote to memory of 5108 3004 6D8F.tmp 104 PID 3004 wrote to memory of 5108 3004 6D8F.tmp 104 PID 5108 wrote to memory of 4060 5108 6DFC.tmp 105 PID 5108 wrote to memory of 4060 5108 6DFC.tmp 105 PID 5108 wrote to memory of 4060 5108 6DFC.tmp 105 PID 4060 wrote to memory of 872 4060 6E4A.tmp 106 PID 4060 wrote to memory of 872 4060 6E4A.tmp 106 PID 4060 wrote to memory of 872 4060 6E4A.tmp 106 PID 872 wrote to memory of 4756 872 6E98.tmp 107 PID 872 wrote to memory of 4756 872 6E98.tmp 107 PID 872 wrote to memory of 4756 872 6E98.tmp 107 PID 4756 wrote to memory of 4804 4756 6EE6.tmp 108 PID 4756 wrote to memory of 4804 4756 6EE6.tmp 108 PID 4756 wrote to memory of 4804 4756 6EE6.tmp 108 PID 4804 wrote to memory of 4608 4804 6F44.tmp 109 PID 4804 wrote to memory of 4608 4804 6F44.tmp 109 PID 4804 wrote to memory of 4608 4804 6F44.tmp 109 PID 4608 wrote to memory of 3140 4608 6FA2.tmp 110 PID 4608 wrote to memory of 3140 4608 6FA2.tmp 110 PID 4608 wrote to memory of 3140 4608 6FA2.tmp 110 PID 3140 wrote to memory of 2992 3140 700F.tmp 111 PID 3140 wrote to memory of 2992 3140 700F.tmp 111 PID 3140 wrote to memory of 2992 3140 700F.tmp 111 PID 2992 wrote to memory of 3284 2992 708C.tmp 112 PID 2992 wrote to memory of 3284 2992 708C.tmp 112 PID 2992 wrote to memory of 3284 2992 708C.tmp 112 PID 3284 wrote to memory of 3012 3284 70FA.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"23⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"24⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"25⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"26⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"27⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"28⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"29⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"30⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"31⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"32⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"33⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"34⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"35⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"36⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"37⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"38⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"39⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"40⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"41⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"42⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"43⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"44⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"45⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"46⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"47⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"48⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"49⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"50⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"51⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"52⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"53⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"54⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"55⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"56⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"57⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"58⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"59⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"60⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"62⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"63⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"64⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"65⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"66⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"67⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"68⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"69⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"70⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"71⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"72⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"73⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"74⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"75⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"76⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"77⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"78⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"79⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"80⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"81⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"82⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"83⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"84⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"85⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"86⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"87⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"88⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"89⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"90⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"91⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"92⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"93⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"94⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"95⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"96⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"97⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"98⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"99⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"100⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"101⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"102⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"103⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"104⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"105⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"106⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"107⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"108⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"109⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"110⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"111⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"112⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"113⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"114⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"115⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"116⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"117⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"118⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"119⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"120⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"121⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"122⤵PID:1836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-