Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe
-
Size
529KB
-
MD5
d39eaffbaab3fb6a96b84af449d71c47
-
SHA1
abeb66ac5537f3bef24cdfcd74f6c6a43482910f
-
SHA256
8619dd0e8120691b1c6a19d63220bc2930374877d1df57e4a935378512d0af4f
-
SHA512
910601f8892c20cd113e8e9b4f5976aa607963f002b7617a70f65d501587022b0542896abf7569095a7457a009a1725af4ca10281d375704805f7ca7092690af
-
SSDEEP
12288:NU5rCOTeijFw/QhX9la52qRiXaM4M3TZwlH4Hp:NUQOJjF7hX9l1qRCa4TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1448 3BB1.tmp 3668 3C4D.tmp 2400 3CAB.tmp 5044 3D38.tmp 4856 3DA5.tmp 4640 3E12.tmp 3716 3F3B.tmp 4000 3F99.tmp 2992 3FF7.tmp 4316 4064.tmp 3280 40E1.tmp 3676 413F.tmp 4384 419D.tmp 436 41FA.tmp 3016 4258.tmp 4068 42A6.tmp 3824 4323.tmp 3224 4371.tmp 3880 43DF.tmp 2340 444C.tmp 3944 44AA.tmp 4816 44F8.tmp 4464 4556.tmp 1556 45B4.tmp 1732 4611.tmp 1560 469E.tmp 3772 470B.tmp 1492 4779.tmp 1724 47D6.tmp 1884 4853.tmp 2496 48D0.tmp 1392 493E.tmp 1872 49BB.tmp 3220 4A09.tmp 4712 4A57.tmp 764 4AA5.tmp 2568 4AF3.tmp 2316 4B41.tmp 2376 4B9F.tmp 3308 4BED.tmp 3388 4C3B.tmp 3128 4C99.tmp 4576 4CF7.tmp 2264 4D55.tmp 820 4DA3.tmp 1448 4DF1.tmp 3336 4E3F.tmp 636 4E9D.tmp 5048 4EFB.tmp 4852 4F49.tmp 1424 4FA6.tmp 4916 5004.tmp 628 5052.tmp 5060 50A0.tmp 2160 50EF.tmp 4132 513D.tmp 3620 519A.tmp 3608 51F8.tmp 2840 5256.tmp 4000 52B4.tmp 2528 5311.tmp 3928 536F.tmp 1952 53CD.tmp 4620 541B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3348 wrote to memory of 1448 3348 2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe 84 PID 3348 wrote to memory of 1448 3348 2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe 84 PID 3348 wrote to memory of 1448 3348 2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe 84 PID 1448 wrote to memory of 3668 1448 3BB1.tmp 85 PID 1448 wrote to memory of 3668 1448 3BB1.tmp 85 PID 1448 wrote to memory of 3668 1448 3BB1.tmp 85 PID 3668 wrote to memory of 2400 3668 3C4D.tmp 86 PID 3668 wrote to memory of 2400 3668 3C4D.tmp 86 PID 3668 wrote to memory of 2400 3668 3C4D.tmp 86 PID 2400 wrote to memory of 5044 2400 3CAB.tmp 88 PID 2400 wrote to memory of 5044 2400 3CAB.tmp 88 PID 2400 wrote to memory of 5044 2400 3CAB.tmp 88 PID 5044 wrote to memory of 4856 5044 3D38.tmp 89 PID 5044 wrote to memory of 4856 5044 3D38.tmp 89 PID 5044 wrote to memory of 4856 5044 3D38.tmp 89 PID 4856 wrote to memory of 4640 4856 3DA5.tmp 91 PID 4856 wrote to memory of 4640 4856 3DA5.tmp 91 PID 4856 wrote to memory of 4640 4856 3DA5.tmp 91 PID 4640 wrote to memory of 3716 4640 3E12.tmp 92 PID 4640 wrote to memory of 3716 4640 3E12.tmp 92 PID 4640 wrote to memory of 3716 4640 3E12.tmp 92 PID 3716 wrote to memory of 4000 3716 3F3B.tmp 94 PID 3716 wrote to memory of 4000 3716 3F3B.tmp 94 PID 3716 wrote to memory of 4000 3716 3F3B.tmp 94 PID 4000 wrote to memory of 2992 4000 3F99.tmp 95 PID 4000 wrote to memory of 2992 4000 3F99.tmp 95 PID 4000 wrote to memory of 2992 4000 3F99.tmp 95 PID 2992 wrote to memory of 4316 2992 3FF7.tmp 96 PID 2992 wrote to memory of 4316 2992 3FF7.tmp 96 PID 2992 wrote to memory of 4316 2992 3FF7.tmp 96 PID 4316 wrote to memory of 3280 4316 4064.tmp 98 PID 4316 wrote to memory of 3280 4316 4064.tmp 98 PID 4316 wrote to memory of 3280 4316 4064.tmp 98 PID 3280 wrote to memory of 3676 3280 40E1.tmp 99 PID 3280 wrote to memory of 3676 3280 40E1.tmp 99 PID 3280 wrote to memory of 3676 3280 40E1.tmp 99 PID 3676 wrote to memory of 4384 3676 413F.tmp 100 PID 3676 wrote to memory of 4384 3676 413F.tmp 100 PID 3676 wrote to memory of 4384 3676 413F.tmp 100 PID 4384 wrote to memory of 436 4384 419D.tmp 101 PID 4384 wrote to memory of 436 4384 419D.tmp 101 PID 4384 wrote to memory of 436 4384 419D.tmp 101 PID 436 wrote to memory of 3016 436 41FA.tmp 102 PID 436 wrote to memory of 3016 436 41FA.tmp 102 PID 436 wrote to memory of 3016 436 41FA.tmp 102 PID 3016 wrote to memory of 4068 3016 4258.tmp 103 PID 3016 wrote to memory of 4068 3016 4258.tmp 103 PID 3016 wrote to memory of 4068 3016 4258.tmp 103 PID 4068 wrote to memory of 3824 4068 42A6.tmp 104 PID 4068 wrote to memory of 3824 4068 42A6.tmp 104 PID 4068 wrote to memory of 3824 4068 42A6.tmp 104 PID 3824 wrote to memory of 3224 3824 4323.tmp 105 PID 3824 wrote to memory of 3224 3824 4323.tmp 105 PID 3824 wrote to memory of 3224 3824 4323.tmp 105 PID 3224 wrote to memory of 3880 3224 4371.tmp 106 PID 3224 wrote to memory of 3880 3224 4371.tmp 106 PID 3224 wrote to memory of 3880 3224 4371.tmp 106 PID 3880 wrote to memory of 2340 3880 43DF.tmp 107 PID 3880 wrote to memory of 2340 3880 43DF.tmp 107 PID 3880 wrote to memory of 2340 3880 43DF.tmp 107 PID 2340 wrote to memory of 3944 2340 444C.tmp 108 PID 2340 wrote to memory of 3944 2340 444C.tmp 108 PID 2340 wrote to memory of 3944 2340 444C.tmp 108 PID 3944 wrote to memory of 4816 3944 44AA.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_d39eaffbaab3fb6a96b84af449d71c47_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"C:\Users\Admin\AppData\Local\Temp\3BB1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"23⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"24⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"25⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"26⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"27⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"28⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"29⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"30⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"31⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"32⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"33⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"34⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"35⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"36⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"37⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"38⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"39⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"40⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"41⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"42⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"43⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"44⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"45⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"46⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"47⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"48⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"49⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"50⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"51⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"52⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"53⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"54⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"56⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"57⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"58⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"59⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"60⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"61⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"62⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"63⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"64⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"65⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"66⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"67⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"68⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"69⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"70⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"71⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"72⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"73⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"74⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"75⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"76⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"77⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"78⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"79⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"80⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"81⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"82⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"83⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"84⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"85⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"86⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"87⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"88⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"89⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"90⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"91⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"92⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"94⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"95⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"96⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"97⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"98⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"99⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"100⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"101⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"102⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"103⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"104⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"105⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"106⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"107⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"108⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"109⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"110⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"111⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"112⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"113⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"114⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"115⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"116⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"117⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"118⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"119⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"120⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"121⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"122⤵PID:4276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-