Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe
-
Size
527KB
-
MD5
cfa0d99c1295bbb509bdb88adc74bc10
-
SHA1
fe995182c9dedca76cf714a7eeaa2a8644f08939
-
SHA256
5b413c5121ff886397244a112579cd1c188c8e806bb02c60d96e9e01288dc129
-
SHA512
3f0ab56d59f6fe90874eb4a6b45b226d1caf494372933cd8f1721052e2afa26bf800f6735a7aba7956998baba09669247ef58b49734b2776026a074adcd3b62f
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDY5CL0is2MfAj7HTtXurPxJjADUyJndsH3zZ3+:fU5rCOTeidGYpM4f5eXADp8DZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2416 EADD.tmp 4264 EC35.tmp 3392 ECF0.tmp 4768 EE09.tmp 2184 EEE4.tmp 4744 EFBF.tmp 416 F0A9.tmp 2072 F211.tmp 60 F2DC.tmp 4992 F8A8.tmp 2084 FA00.tmp 1100 FB09.tmp 3632 FC03.tmp 644 FCAF.tmp 4100 FD7A.tmp 1964 FE55.tmp 496 FF01.tmp 2388 FFCC.tmp 5112 88.tmp 640 143.tmp 4112 1EF.tmp 4756 27C.tmp 3104 376.tmp 4060 3F3.tmp 816 4CD.tmp 976 5D7.tmp 2432 673.tmp 5004 73E.tmp 4332 7EA.tmp 2304 8D5.tmp 4884 952.tmp 4980 A0D.tmp 4388 AA9.tmp 3788 B55.tmp 4624 BF2.tmp 2984 C6F.tmp 3288 CFB.tmp 3976 D88.tmp 4360 E05.tmp 4296 E72.tmp 2908 EE0.tmp 1360 F6C.tmp 2644 FF9.tmp 1860 1085.tmp 3392 1112.tmp 3736 11AE.tmp 2612 124B.tmp 4492 12C8.tmp 3232 1335.tmp 3228 13B2.tmp 2732 144E.tmp 4016 14CB.tmp 4992 1548.tmp 2620 15B6.tmp 5012 1623.tmp 2520 1690.tmp 708 171D.tmp 1964 17AA.tmp 5044 1836.tmp 3316 18B3.tmp 2388 1940.tmp 4736 19DC.tmp 4008 1A98.tmp 3544 1B24.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2416 2240 2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe 90 PID 2240 wrote to memory of 2416 2240 2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe 90 PID 2240 wrote to memory of 2416 2240 2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe 90 PID 2416 wrote to memory of 4264 2416 EADD.tmp 91 PID 2416 wrote to memory of 4264 2416 EADD.tmp 91 PID 2416 wrote to memory of 4264 2416 EADD.tmp 91 PID 4264 wrote to memory of 3392 4264 EC35.tmp 92 PID 4264 wrote to memory of 3392 4264 EC35.tmp 92 PID 4264 wrote to memory of 3392 4264 EC35.tmp 92 PID 3392 wrote to memory of 4768 3392 ECF0.tmp 93 PID 3392 wrote to memory of 4768 3392 ECF0.tmp 93 PID 3392 wrote to memory of 4768 3392 ECF0.tmp 93 PID 4768 wrote to memory of 2184 4768 EE09.tmp 94 PID 4768 wrote to memory of 2184 4768 EE09.tmp 94 PID 4768 wrote to memory of 2184 4768 EE09.tmp 94 PID 2184 wrote to memory of 4744 2184 EEE4.tmp 95 PID 2184 wrote to memory of 4744 2184 EEE4.tmp 95 PID 2184 wrote to memory of 4744 2184 EEE4.tmp 95 PID 4744 wrote to memory of 416 4744 EFBF.tmp 96 PID 4744 wrote to memory of 416 4744 EFBF.tmp 96 PID 4744 wrote to memory of 416 4744 EFBF.tmp 96 PID 416 wrote to memory of 2072 416 F0A9.tmp 97 PID 416 wrote to memory of 2072 416 F0A9.tmp 97 PID 416 wrote to memory of 2072 416 F0A9.tmp 97 PID 2072 wrote to memory of 60 2072 F211.tmp 98 PID 2072 wrote to memory of 60 2072 F211.tmp 98 PID 2072 wrote to memory of 60 2072 F211.tmp 98 PID 60 wrote to memory of 4992 60 F2DC.tmp 99 PID 60 wrote to memory of 4992 60 F2DC.tmp 99 PID 60 wrote to memory of 4992 60 F2DC.tmp 99 PID 4992 wrote to memory of 2084 4992 F8A8.tmp 100 PID 4992 wrote to memory of 2084 4992 F8A8.tmp 100 PID 4992 wrote to memory of 2084 4992 F8A8.tmp 100 PID 2084 wrote to memory of 1100 2084 FA00.tmp 101 PID 2084 wrote to memory of 1100 2084 FA00.tmp 101 PID 2084 wrote to memory of 1100 2084 FA00.tmp 101 PID 1100 wrote to memory of 3632 1100 FB09.tmp 102 PID 1100 wrote to memory of 3632 1100 FB09.tmp 102 PID 1100 wrote to memory of 3632 1100 FB09.tmp 102 PID 3632 wrote to memory of 644 3632 FC03.tmp 103 PID 3632 wrote to memory of 644 3632 FC03.tmp 103 PID 3632 wrote to memory of 644 3632 FC03.tmp 103 PID 644 wrote to memory of 4100 644 FCAF.tmp 104 PID 644 wrote to memory of 4100 644 FCAF.tmp 104 PID 644 wrote to memory of 4100 644 FCAF.tmp 104 PID 4100 wrote to memory of 1964 4100 FD7A.tmp 105 PID 4100 wrote to memory of 1964 4100 FD7A.tmp 105 PID 4100 wrote to memory of 1964 4100 FD7A.tmp 105 PID 1964 wrote to memory of 496 1964 FE55.tmp 106 PID 1964 wrote to memory of 496 1964 FE55.tmp 106 PID 1964 wrote to memory of 496 1964 FE55.tmp 106 PID 496 wrote to memory of 2388 496 FF01.tmp 107 PID 496 wrote to memory of 2388 496 FF01.tmp 107 PID 496 wrote to memory of 2388 496 FF01.tmp 107 PID 2388 wrote to memory of 5112 2388 FFCC.tmp 108 PID 2388 wrote to memory of 5112 2388 FFCC.tmp 108 PID 2388 wrote to memory of 5112 2388 FFCC.tmp 108 PID 5112 wrote to memory of 640 5112 88.tmp 109 PID 5112 wrote to memory of 640 5112 88.tmp 109 PID 5112 wrote to memory of 640 5112 88.tmp 109 PID 640 wrote to memory of 4112 640 143.tmp 110 PID 640 wrote to memory of 4112 640 143.tmp 110 PID 640 wrote to memory of 4112 640 143.tmp 110 PID 4112 wrote to memory of 4756 4112 1EF.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_cfa0d99c1295bbb509bdb88adc74bc10_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"23⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"24⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"25⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"26⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"27⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"28⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"29⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"30⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"31⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"32⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"33⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"34⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"35⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"36⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"37⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"38⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"39⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"40⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"42⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"43⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"44⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"45⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"46⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"47⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"48⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"49⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"50⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"51⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"52⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"53⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"54⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"55⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"56⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"57⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"58⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"59⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"60⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"61⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"62⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"63⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"64⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"65⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"66⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"67⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"68⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"69⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"70⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"71⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"72⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"73⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"74⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"75⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"76⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"77⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"78⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"79⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"80⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"82⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"83⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"84⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"85⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"86⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"87⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"88⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"89⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"90⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"91⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"92⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"93⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"94⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"95⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"96⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"97⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"98⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"99⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"100⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"101⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"102⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"103⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"104⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"105⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"106⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"107⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"108⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"109⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"110⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"111⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"112⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"113⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"114⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"115⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"116⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"118⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"119⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"120⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"121⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"122⤵PID:3288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-