Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 11:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe
-
Size
536KB
-
MD5
325bcfddf62a44d9e1eae32dae212aa6
-
SHA1
ccff932117c60c9e8827ea74f619875704ea8058
-
SHA256
52c583cd13d31a4243cd5959fb0cbc34d88224cfa87fdcb37f5578bedbb08dcf
-
SHA512
5a8cb8ed38516c93aa87f269d3075c0c999aeda9212e1ab0a4984d9b8fdd3fbf67cb191eb14628f52105d8a00b32fd341697ba272c0cc62575356c81bc146c19
-
SSDEEP
12288:wU5rCOTeiUV+9nLtgoyqlz9YvAb3oiIZxVJ0ZT9:wUQOJUVcFJ33IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1552 4650.tmp 2260 46DC.tmp 3436 4788.tmp 2824 4834.tmp 5036 490F.tmp 1132 49AB.tmp 2376 4A38.tmp 2132 4AB5.tmp 4972 4B51.tmp 2124 4BED.tmp 4488 4C8A.tmp 4116 4D07.tmp 3700 4DD2.tmp 2176 4E6E.tmp 4416 4EEB.tmp 4348 4F87.tmp 748 4FF5.tmp 4572 5227.tmp 852 52A4.tmp 5060 5340.tmp 1792 53BD.tmp 2796 544A.tmp 1164 54B7.tmp 3240 5554.tmp 2944 55FF.tmp 2344 566D.tmp 3108 5728.tmp 4312 57A5.tmp 4412 5861.tmp 3252 58FD.tmp 4364 596A.tmp 856 5A16.tmp 1424 5A84.tmp 3216 5AF1.tmp 4240 5B5E.tmp 2152 5BCC.tmp 2220 5C49.tmp 756 5CA7.tmp 4580 5D04.tmp 1020 5D91.tmp 3212 5E0E.tmp 4116 5E9B.tmp 4084 5F08.tmp 2080 5F95.tmp 1764 6012.tmp 3540 60AE.tmp 3888 612B.tmp 1876 61C7.tmp 1208 6244.tmp 3000 62A2.tmp 1080 6300.tmp 3068 634E.tmp 3128 639C.tmp 868 63EA.tmp 1056 6448.tmp 4424 64A5.tmp 4164 6503.tmp 2208 6551.tmp 968 659F.tmp 816 65EE.tmp 5112 663C.tmp 1236 6699.tmp 1440 66F7.tmp 1680 6745.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1552 4356 2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe 83 PID 4356 wrote to memory of 1552 4356 2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe 83 PID 4356 wrote to memory of 1552 4356 2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe 83 PID 1552 wrote to memory of 2260 1552 4650.tmp 84 PID 1552 wrote to memory of 2260 1552 4650.tmp 84 PID 1552 wrote to memory of 2260 1552 4650.tmp 84 PID 2260 wrote to memory of 3436 2260 46DC.tmp 86 PID 2260 wrote to memory of 3436 2260 46DC.tmp 86 PID 2260 wrote to memory of 3436 2260 46DC.tmp 86 PID 3436 wrote to memory of 2824 3436 4788.tmp 88 PID 3436 wrote to memory of 2824 3436 4788.tmp 88 PID 3436 wrote to memory of 2824 3436 4788.tmp 88 PID 2824 wrote to memory of 5036 2824 4834.tmp 90 PID 2824 wrote to memory of 5036 2824 4834.tmp 90 PID 2824 wrote to memory of 5036 2824 4834.tmp 90 PID 5036 wrote to memory of 1132 5036 490F.tmp 91 PID 5036 wrote to memory of 1132 5036 490F.tmp 91 PID 5036 wrote to memory of 1132 5036 490F.tmp 91 PID 1132 wrote to memory of 2376 1132 49AB.tmp 92 PID 1132 wrote to memory of 2376 1132 49AB.tmp 92 PID 1132 wrote to memory of 2376 1132 49AB.tmp 92 PID 2376 wrote to memory of 2132 2376 4A38.tmp 93 PID 2376 wrote to memory of 2132 2376 4A38.tmp 93 PID 2376 wrote to memory of 2132 2376 4A38.tmp 93 PID 2132 wrote to memory of 4972 2132 4AB5.tmp 94 PID 2132 wrote to memory of 4972 2132 4AB5.tmp 94 PID 2132 wrote to memory of 4972 2132 4AB5.tmp 94 PID 4972 wrote to memory of 2124 4972 4B51.tmp 95 PID 4972 wrote to memory of 2124 4972 4B51.tmp 95 PID 4972 wrote to memory of 2124 4972 4B51.tmp 95 PID 2124 wrote to memory of 4488 2124 4BED.tmp 96 PID 2124 wrote to memory of 4488 2124 4BED.tmp 96 PID 2124 wrote to memory of 4488 2124 4BED.tmp 96 PID 4488 wrote to memory of 4116 4488 4C8A.tmp 97 PID 4488 wrote to memory of 4116 4488 4C8A.tmp 97 PID 4488 wrote to memory of 4116 4488 4C8A.tmp 97 PID 4116 wrote to memory of 3700 4116 4D07.tmp 98 PID 4116 wrote to memory of 3700 4116 4D07.tmp 98 PID 4116 wrote to memory of 3700 4116 4D07.tmp 98 PID 3700 wrote to memory of 2176 3700 4DD2.tmp 99 PID 3700 wrote to memory of 2176 3700 4DD2.tmp 99 PID 3700 wrote to memory of 2176 3700 4DD2.tmp 99 PID 2176 wrote to memory of 4416 2176 4E6E.tmp 100 PID 2176 wrote to memory of 4416 2176 4E6E.tmp 100 PID 2176 wrote to memory of 4416 2176 4E6E.tmp 100 PID 4416 wrote to memory of 4348 4416 4EEB.tmp 101 PID 4416 wrote to memory of 4348 4416 4EEB.tmp 101 PID 4416 wrote to memory of 4348 4416 4EEB.tmp 101 PID 4348 wrote to memory of 748 4348 4F87.tmp 102 PID 4348 wrote to memory of 748 4348 4F87.tmp 102 PID 4348 wrote to memory of 748 4348 4F87.tmp 102 PID 748 wrote to memory of 4572 748 4FF5.tmp 103 PID 748 wrote to memory of 4572 748 4FF5.tmp 103 PID 748 wrote to memory of 4572 748 4FF5.tmp 103 PID 4572 wrote to memory of 852 4572 5227.tmp 105 PID 4572 wrote to memory of 852 4572 5227.tmp 105 PID 4572 wrote to memory of 852 4572 5227.tmp 105 PID 852 wrote to memory of 5060 852 52A4.tmp 106 PID 852 wrote to memory of 5060 852 52A4.tmp 106 PID 852 wrote to memory of 5060 852 52A4.tmp 106 PID 5060 wrote to memory of 1792 5060 5340.tmp 107 PID 5060 wrote to memory of 1792 5060 5340.tmp 107 PID 5060 wrote to memory of 1792 5060 5340.tmp 107 PID 1792 wrote to memory of 2796 1792 53BD.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_325bcfddf62a44d9e1eae32dae212aa6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"23⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"24⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"25⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"26⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"27⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"28⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"29⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"30⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"31⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"32⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"33⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"34⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"35⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"36⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"37⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"38⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"39⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"40⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"41⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"42⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"43⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"44⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"45⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"46⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"47⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"48⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"49⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"50⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"51⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"52⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"53⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"54⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"55⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"56⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"57⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"58⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"59⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"60⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"61⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"62⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"63⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"64⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"65⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"66⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"67⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"68⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"69⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"70⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"71⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"74⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"75⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"76⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"77⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"78⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"79⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"80⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"81⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"82⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"83⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"84⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"87⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"88⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"89⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"90⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"91⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"92⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"93⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"94⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"95⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"96⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"98⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"99⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"100⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"101⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"102⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"103⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"104⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"105⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"106⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"107⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"108⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"109⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"110⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"111⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"112⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"113⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"114⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"115⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"116⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"117⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"118⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"119⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"120⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"121⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-