Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe
-
Size
520KB
-
MD5
5976e141c43bc2ae875c76a40e14d325
-
SHA1
2ff8f6b71fbb9fdca9c7b1cb677d59cbc92cdcad
-
SHA256
507fcffa0e1c1c298a7538b69ec8b37029c6556f440ff2ce7be2a3ef29379267
-
SHA512
650f2e1175069c4ef59d1c56f1bf6ece8e3560bf02ea7f9d42614798f8d24fc83a4eaa4102c65f4a2ae3367f4a0611354abffd998d45aa3792cdf622d795c252
-
SSDEEP
12288:gj8fuxR21t5i8fol205JFz2ON2TId1NfvEWcHNZ:gj8fuK1GYQfF92Ed1hvElHN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1708 30C4.tmp 4652 3151.tmp 4732 319F.tmp 1828 31ED.tmp 4680 324B.tmp 2828 3299.tmp 3732 32F7.tmp 1480 3345.tmp 836 33B2.tmp 2604 3410.tmp 3576 345E.tmp 4544 34AC.tmp 1792 34FA.tmp 1640 3577.tmp 1060 35D5.tmp 3968 3623.tmp 4656 3671.tmp 900 36BF.tmp 516 371D.tmp 2104 377B.tmp 4992 37D9.tmp 3300 3836.tmp 4860 3894.tmp 3980 38E2.tmp 2460 3940.tmp 3992 398E.tmp 928 39DC.tmp 4104 3A2A.tmp 3628 3A79.tmp 1432 3AD6.tmp 3344 3B34.tmp 216 3B92.tmp 2196 3BE0.tmp 2616 3C2E.tmp 816 3C7C.tmp 3940 3CCA.tmp 4996 3D18.tmp 4740 3D67.tmp 3308 3DB5.tmp 4180 3DF3.tmp 384 3E70.tmp 2192 3EBE.tmp 3748 3F0C.tmp 2672 3F5B.tmp 2840 3FA9.tmp 2660 3FF7.tmp 1912 4035.tmp 2332 4083.tmp 4548 40C2.tmp 5084 4110.tmp 4956 415E.tmp 3052 41AC.tmp 4556 41FA.tmp 5008 4249.tmp 2044 4297.tmp 5104 42E5.tmp 3516 4343.tmp 1864 43A0.tmp 2572 43EE.tmp 2240 444C.tmp 1440 4508.tmp 3576 45A4.tmp 3744 4611.tmp 3064 467F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 1708 3932 2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe 83 PID 3932 wrote to memory of 1708 3932 2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe 83 PID 3932 wrote to memory of 1708 3932 2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe 83 PID 1708 wrote to memory of 4652 1708 30C4.tmp 85 PID 1708 wrote to memory of 4652 1708 30C4.tmp 85 PID 1708 wrote to memory of 4652 1708 30C4.tmp 85 PID 4652 wrote to memory of 4732 4652 3151.tmp 87 PID 4652 wrote to memory of 4732 4652 3151.tmp 87 PID 4652 wrote to memory of 4732 4652 3151.tmp 87 PID 4732 wrote to memory of 1828 4732 319F.tmp 89 PID 4732 wrote to memory of 1828 4732 319F.tmp 89 PID 4732 wrote to memory of 1828 4732 319F.tmp 89 PID 1828 wrote to memory of 4680 1828 31ED.tmp 90 PID 1828 wrote to memory of 4680 1828 31ED.tmp 90 PID 1828 wrote to memory of 4680 1828 31ED.tmp 90 PID 4680 wrote to memory of 2828 4680 324B.tmp 92 PID 4680 wrote to memory of 2828 4680 324B.tmp 92 PID 4680 wrote to memory of 2828 4680 324B.tmp 92 PID 2828 wrote to memory of 3732 2828 3299.tmp 93 PID 2828 wrote to memory of 3732 2828 3299.tmp 93 PID 2828 wrote to memory of 3732 2828 3299.tmp 93 PID 3732 wrote to memory of 1480 3732 32F7.tmp 94 PID 3732 wrote to memory of 1480 3732 32F7.tmp 94 PID 3732 wrote to memory of 1480 3732 32F7.tmp 94 PID 1480 wrote to memory of 836 1480 3345.tmp 95 PID 1480 wrote to memory of 836 1480 3345.tmp 95 PID 1480 wrote to memory of 836 1480 3345.tmp 95 PID 836 wrote to memory of 2604 836 33B2.tmp 96 PID 836 wrote to memory of 2604 836 33B2.tmp 96 PID 836 wrote to memory of 2604 836 33B2.tmp 96 PID 2604 wrote to memory of 3576 2604 3410.tmp 97 PID 2604 wrote to memory of 3576 2604 3410.tmp 97 PID 2604 wrote to memory of 3576 2604 3410.tmp 97 PID 3576 wrote to memory of 4544 3576 345E.tmp 98 PID 3576 wrote to memory of 4544 3576 345E.tmp 98 PID 3576 wrote to memory of 4544 3576 345E.tmp 98 PID 4544 wrote to memory of 1792 4544 34AC.tmp 99 PID 4544 wrote to memory of 1792 4544 34AC.tmp 99 PID 4544 wrote to memory of 1792 4544 34AC.tmp 99 PID 1792 wrote to memory of 1640 1792 34FA.tmp 100 PID 1792 wrote to memory of 1640 1792 34FA.tmp 100 PID 1792 wrote to memory of 1640 1792 34FA.tmp 100 PID 1640 wrote to memory of 1060 1640 3577.tmp 101 PID 1640 wrote to memory of 1060 1640 3577.tmp 101 PID 1640 wrote to memory of 1060 1640 3577.tmp 101 PID 1060 wrote to memory of 3968 1060 35D5.tmp 102 PID 1060 wrote to memory of 3968 1060 35D5.tmp 102 PID 1060 wrote to memory of 3968 1060 35D5.tmp 102 PID 3968 wrote to memory of 4656 3968 3623.tmp 103 PID 3968 wrote to memory of 4656 3968 3623.tmp 103 PID 3968 wrote to memory of 4656 3968 3623.tmp 103 PID 4656 wrote to memory of 900 4656 3671.tmp 104 PID 4656 wrote to memory of 900 4656 3671.tmp 104 PID 4656 wrote to memory of 900 4656 3671.tmp 104 PID 900 wrote to memory of 516 900 36BF.tmp 105 PID 900 wrote to memory of 516 900 36BF.tmp 105 PID 900 wrote to memory of 516 900 36BF.tmp 105 PID 516 wrote to memory of 2104 516 371D.tmp 106 PID 516 wrote to memory of 2104 516 371D.tmp 106 PID 516 wrote to memory of 2104 516 371D.tmp 106 PID 2104 wrote to memory of 4992 2104 377B.tmp 107 PID 2104 wrote to memory of 4992 2104 377B.tmp 107 PID 2104 wrote to memory of 4992 2104 377B.tmp 107 PID 4992 wrote to memory of 3300 4992 37D9.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_5976e141c43bc2ae875c76a40e14d325_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\30C4.tmp"C:\Users\Admin\AppData\Local\Temp\30C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3151.tmp"C:\Users\Admin\AppData\Local\Temp\3151.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\319F.tmp"C:\Users\Admin\AppData\Local\Temp\319F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\31ED.tmp"C:\Users\Admin\AppData\Local\Temp\31ED.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\3299.tmp"C:\Users\Admin\AppData\Local\Temp\3299.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3577.tmp"C:\Users\Admin\AppData\Local\Temp\3577.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\35D5.tmp"C:\Users\Admin\AppData\Local\Temp\35D5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"23⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"24⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"25⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"26⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"27⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"28⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"29⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"30⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"31⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"32⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"33⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"34⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"35⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"36⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"37⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"38⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"39⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"40⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"41⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"42⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"43⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"44⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"45⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"46⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"47⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"48⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"49⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"50⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\40C2.tmp"C:\Users\Admin\AppData\Local\Temp\40C2.tmp"51⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"52⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"53⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"54⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"55⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"56⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"57⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"58⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"59⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"60⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"61⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"62⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"63⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"64⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"65⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"66⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"67⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"68⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"69⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"70⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"72⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"73⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"74⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"75⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"76⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"77⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"78⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"79⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"80⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"81⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"82⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"83⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"84⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"85⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"86⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"87⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"88⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"89⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"90⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"91⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"92⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"93⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"94⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"95⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"96⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"97⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"98⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"99⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"100⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"101⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"102⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"103⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"104⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"105⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"106⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"107⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"108⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"109⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"110⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"111⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"112⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"113⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"114⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"115⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"116⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"117⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"118⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"119⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"120⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"121⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"122⤵PID:4700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-