Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe
-
Size
536KB
-
MD5
892f190aa70d1af70dd250bf6100da7a
-
SHA1
caad08358d8f06664153db1c1c9d1d72afd65659
-
SHA256
2af08e5a8138d6d11b3da58d0ed80c65b02e4270cf7b8ff94f10a79d4f61bf78
-
SHA512
ab84055d82c7bdc72cf8cf84f180397c35ff6ba215ab0bb79b2ac2f54ea3dade79af7d03e4f2e74febeab9ed8dbb192b3df00c490f6b3cb1e4d6ef2b3c442609
-
SSDEEP
12288:wU5rCOTeiU4w7+aPbXyf48VdGeHO6mIZxVJ0ZT9:wUQOJU4w+UjF8eaO6mIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1324 3846.tmp 4780 3911.tmp 2924 398E.tmp 1892 3A4A.tmp 1916 3B15.tmp 2668 3BC1.tmp 1092 3C5D.tmp 1320 3CF9.tmp 4220 3D67.tmp 5028 3E22.tmp 3196 3EBE.tmp 2408 3F5B.tmp 1776 3FC8.tmp 412 4083.tmp 3520 4110.tmp 1660 41AC.tmp 2104 4239.tmp 5104 42D5.tmp 4336 4391.tmp 4412 440E.tmp 316 44AA.tmp 4892 4546.tmp 3416 45D3.tmp 1820 466F.tmp 3716 470B.tmp 4716 47A8.tmp 2168 4863.tmp 3664 48E0.tmp 2396 497C.tmp 3916 49F9.tmp 2508 4A76.tmp 384 4B13.tmp 4816 4BAF.tmp 404 4C0D.tmp 1892 4C7A.tmp 4296 4CD8.tmp 216 4D35.tmp 4168 4D84.tmp 5004 4DE1.tmp 2044 4E4F.tmp 3256 4ECC.tmp 1184 4F29.tmp 4788 4FB6.tmp 1392 5023.tmp 1216 50A0.tmp 3248 50FE.tmp 408 516C.tmp 692 51D9.tmp 780 5237.tmp 3236 5285.tmp 2536 52D3.tmp 2020 5321.tmp 1984 537F.tmp 3080 53CD.tmp 640 541B.tmp 3052 5479.tmp 2216 54C7.tmp 4056 5525.tmp 1980 5573.tmp 4384 55C1.tmp 5008 560F.tmp 1604 565D.tmp 2404 56AB.tmp 4716 56F9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1324 1936 2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe 83 PID 1936 wrote to memory of 1324 1936 2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe 83 PID 1936 wrote to memory of 1324 1936 2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe 83 PID 1324 wrote to memory of 4780 1324 3846.tmp 84 PID 1324 wrote to memory of 4780 1324 3846.tmp 84 PID 1324 wrote to memory of 4780 1324 3846.tmp 84 PID 4780 wrote to memory of 2924 4780 3911.tmp 85 PID 4780 wrote to memory of 2924 4780 3911.tmp 85 PID 4780 wrote to memory of 2924 4780 3911.tmp 85 PID 2924 wrote to memory of 1892 2924 398E.tmp 88 PID 2924 wrote to memory of 1892 2924 398E.tmp 88 PID 2924 wrote to memory of 1892 2924 398E.tmp 88 PID 1892 wrote to memory of 1916 1892 3A4A.tmp 89 PID 1892 wrote to memory of 1916 1892 3A4A.tmp 89 PID 1892 wrote to memory of 1916 1892 3A4A.tmp 89 PID 1916 wrote to memory of 2668 1916 3B15.tmp 90 PID 1916 wrote to memory of 2668 1916 3B15.tmp 90 PID 1916 wrote to memory of 2668 1916 3B15.tmp 90 PID 2668 wrote to memory of 1092 2668 3BC1.tmp 92 PID 2668 wrote to memory of 1092 2668 3BC1.tmp 92 PID 2668 wrote to memory of 1092 2668 3BC1.tmp 92 PID 1092 wrote to memory of 1320 1092 3C5D.tmp 93 PID 1092 wrote to memory of 1320 1092 3C5D.tmp 93 PID 1092 wrote to memory of 1320 1092 3C5D.tmp 93 PID 1320 wrote to memory of 4220 1320 3CF9.tmp 94 PID 1320 wrote to memory of 4220 1320 3CF9.tmp 94 PID 1320 wrote to memory of 4220 1320 3CF9.tmp 94 PID 4220 wrote to memory of 5028 4220 3D67.tmp 95 PID 4220 wrote to memory of 5028 4220 3D67.tmp 95 PID 4220 wrote to memory of 5028 4220 3D67.tmp 95 PID 5028 wrote to memory of 3196 5028 3E22.tmp 96 PID 5028 wrote to memory of 3196 5028 3E22.tmp 96 PID 5028 wrote to memory of 3196 5028 3E22.tmp 96 PID 3196 wrote to memory of 2408 3196 3EBE.tmp 97 PID 3196 wrote to memory of 2408 3196 3EBE.tmp 97 PID 3196 wrote to memory of 2408 3196 3EBE.tmp 97 PID 2408 wrote to memory of 1776 2408 3F5B.tmp 98 PID 2408 wrote to memory of 1776 2408 3F5B.tmp 98 PID 2408 wrote to memory of 1776 2408 3F5B.tmp 98 PID 1776 wrote to memory of 412 1776 3FC8.tmp 99 PID 1776 wrote to memory of 412 1776 3FC8.tmp 99 PID 1776 wrote to memory of 412 1776 3FC8.tmp 99 PID 412 wrote to memory of 3520 412 4083.tmp 100 PID 412 wrote to memory of 3520 412 4083.tmp 100 PID 412 wrote to memory of 3520 412 4083.tmp 100 PID 3520 wrote to memory of 1660 3520 4110.tmp 101 PID 3520 wrote to memory of 1660 3520 4110.tmp 101 PID 3520 wrote to memory of 1660 3520 4110.tmp 101 PID 1660 wrote to memory of 2104 1660 41AC.tmp 102 PID 1660 wrote to memory of 2104 1660 41AC.tmp 102 PID 1660 wrote to memory of 2104 1660 41AC.tmp 102 PID 2104 wrote to memory of 5104 2104 4239.tmp 103 PID 2104 wrote to memory of 5104 2104 4239.tmp 103 PID 2104 wrote to memory of 5104 2104 4239.tmp 103 PID 5104 wrote to memory of 4336 5104 42D5.tmp 104 PID 5104 wrote to memory of 4336 5104 42D5.tmp 104 PID 5104 wrote to memory of 4336 5104 42D5.tmp 104 PID 4336 wrote to memory of 4412 4336 4391.tmp 107 PID 4336 wrote to memory of 4412 4336 4391.tmp 107 PID 4336 wrote to memory of 4412 4336 4391.tmp 107 PID 4412 wrote to memory of 316 4412 440E.tmp 108 PID 4412 wrote to memory of 316 4412 440E.tmp 108 PID 4412 wrote to memory of 316 4412 440E.tmp 108 PID 316 wrote to memory of 4892 316 44AA.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_892f190aa70d1af70dd250bf6100da7a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"23⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"24⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"25⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"26⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"27⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"28⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"29⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"30⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"31⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"32⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"33⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"34⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"35⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"36⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"37⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"38⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"39⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"40⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"41⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"42⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"43⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"44⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"45⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"46⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"47⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"48⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"49⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"50⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"51⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"52⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"53⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"54⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"55⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"56⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"57⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"58⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"59⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"60⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"61⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"62⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"63⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"64⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"65⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"66⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"67⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"68⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"69⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"70⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"71⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"72⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"73⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"74⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"75⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"76⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"78⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"79⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"80⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"81⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"82⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"83⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"84⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"85⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"86⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"87⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"88⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"89⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"90⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"91⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"93⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"94⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"96⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"97⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"98⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"99⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"100⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"101⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"102⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"103⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"104⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"105⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"106⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"108⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"109⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"110⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"111⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"112⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"113⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"114⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"115⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"116⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"117⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"118⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"119⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"120⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"121⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-