Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe
-
Size
529KB
-
MD5
9c3289f2ad717e1048543def5247b7bb
-
SHA1
45a00b8b1a499eb0b80b5a3c95335090de197f6d
-
SHA256
e5bfc93f5543cf0ffadb0c2f1bc60c37bf1e616bf0bd4c091f43be1ed0f9b50b
-
SHA512
fb98a75b2cd115ff8b6889501b43eeaafa305b1be80069417296a619d2d0ebeaa2c9190971aa774a9c34584d935180538a174814505e6fea727d4980106f2d55
-
SSDEEP
12288:NU5rCOTeijgiH9horwoLDLsUym0hQAUQxSOY9RCeTZwlH4Hp:NUQOJjgiAcQns/OAUqY9R1TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4516 4016.tmp 1044 40B2.tmp 220 412F.tmp 4584 419D.tmp 1292 4229.tmp 4428 4297.tmp 2212 42F4.tmp 4776 4362.tmp 4992 43CF.tmp 5000 444C.tmp 3092 44C9.tmp 2076 4517.tmp 4220 4565.tmp 3044 45C3.tmp 3484 4621.tmp 4144 469E.tmp 5056 46FC.tmp 2280 4779.tmp 528 47C7.tmp 2124 4825.tmp 3740 48A2.tmp 4880 490F.tmp 2192 498C.tmp 2340 4A19.tmp 1244 4A86.tmp 4388 4B03.tmp 3512 4B61.tmp 4840 4BCE.tmp 2516 4C2C.tmp 4360 4C8A.tmp 1044 4CF7.tmp 4756 4D64.tmp 5080 4DD2.tmp 700 4E2F.tmp 3212 4E8D.tmp 892 4EEB.tmp 1100 4F49.tmp 4496 4F97.tmp 5000 4FE5.tmp 5088 5033.tmp 1596 5081.tmp 836 50CF.tmp 1772 511D.tmp 2884 516C.tmp 4696 51BA.tmp 4848 5208.tmp 2256 5266.tmp 3504 52B4.tmp 640 5311.tmp 2128 5360.tmp 1312 53AE.tmp 2792 53FC.tmp 1600 545A.tmp 3956 54B7.tmp 4384 5515.tmp 3692 5563.tmp 3088 55C1.tmp 2876 560F.tmp 4528 566D.tmp 3968 56CB.tmp 1532 5728.tmp 1388 5776.tmp 4480 57D4.tmp 704 5832.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 4516 1524 2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe 84 PID 1524 wrote to memory of 4516 1524 2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe 84 PID 1524 wrote to memory of 4516 1524 2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe 84 PID 4516 wrote to memory of 1044 4516 4016.tmp 85 PID 4516 wrote to memory of 1044 4516 4016.tmp 85 PID 4516 wrote to memory of 1044 4516 4016.tmp 85 PID 1044 wrote to memory of 220 1044 40B2.tmp 86 PID 1044 wrote to memory of 220 1044 40B2.tmp 86 PID 1044 wrote to memory of 220 1044 40B2.tmp 86 PID 220 wrote to memory of 4584 220 412F.tmp 87 PID 220 wrote to memory of 4584 220 412F.tmp 87 PID 220 wrote to memory of 4584 220 412F.tmp 87 PID 4584 wrote to memory of 1292 4584 419D.tmp 90 PID 4584 wrote to memory of 1292 4584 419D.tmp 90 PID 4584 wrote to memory of 1292 4584 419D.tmp 90 PID 1292 wrote to memory of 4428 1292 4229.tmp 92 PID 1292 wrote to memory of 4428 1292 4229.tmp 92 PID 1292 wrote to memory of 4428 1292 4229.tmp 92 PID 4428 wrote to memory of 2212 4428 4297.tmp 93 PID 4428 wrote to memory of 2212 4428 4297.tmp 93 PID 4428 wrote to memory of 2212 4428 4297.tmp 93 PID 2212 wrote to memory of 4776 2212 42F4.tmp 94 PID 2212 wrote to memory of 4776 2212 42F4.tmp 94 PID 2212 wrote to memory of 4776 2212 42F4.tmp 94 PID 4776 wrote to memory of 4992 4776 4362.tmp 95 PID 4776 wrote to memory of 4992 4776 4362.tmp 95 PID 4776 wrote to memory of 4992 4776 4362.tmp 95 PID 4992 wrote to memory of 5000 4992 43CF.tmp 96 PID 4992 wrote to memory of 5000 4992 43CF.tmp 96 PID 4992 wrote to memory of 5000 4992 43CF.tmp 96 PID 5000 wrote to memory of 3092 5000 444C.tmp 97 PID 5000 wrote to memory of 3092 5000 444C.tmp 97 PID 5000 wrote to memory of 3092 5000 444C.tmp 97 PID 3092 wrote to memory of 2076 3092 44C9.tmp 98 PID 3092 wrote to memory of 2076 3092 44C9.tmp 98 PID 3092 wrote to memory of 2076 3092 44C9.tmp 98 PID 2076 wrote to memory of 4220 2076 4517.tmp 99 PID 2076 wrote to memory of 4220 2076 4517.tmp 99 PID 2076 wrote to memory of 4220 2076 4517.tmp 99 PID 4220 wrote to memory of 3044 4220 4565.tmp 100 PID 4220 wrote to memory of 3044 4220 4565.tmp 100 PID 4220 wrote to memory of 3044 4220 4565.tmp 100 PID 3044 wrote to memory of 3484 3044 45C3.tmp 101 PID 3044 wrote to memory of 3484 3044 45C3.tmp 101 PID 3044 wrote to memory of 3484 3044 45C3.tmp 101 PID 3484 wrote to memory of 4144 3484 4621.tmp 102 PID 3484 wrote to memory of 4144 3484 4621.tmp 102 PID 3484 wrote to memory of 4144 3484 4621.tmp 102 PID 4144 wrote to memory of 5056 4144 469E.tmp 103 PID 4144 wrote to memory of 5056 4144 469E.tmp 103 PID 4144 wrote to memory of 5056 4144 469E.tmp 103 PID 5056 wrote to memory of 2280 5056 46FC.tmp 104 PID 5056 wrote to memory of 2280 5056 46FC.tmp 104 PID 5056 wrote to memory of 2280 5056 46FC.tmp 104 PID 2280 wrote to memory of 528 2280 4779.tmp 105 PID 2280 wrote to memory of 528 2280 4779.tmp 105 PID 2280 wrote to memory of 528 2280 4779.tmp 105 PID 528 wrote to memory of 2124 528 47C7.tmp 106 PID 528 wrote to memory of 2124 528 47C7.tmp 106 PID 528 wrote to memory of 2124 528 47C7.tmp 106 PID 2124 wrote to memory of 3740 2124 4825.tmp 109 PID 2124 wrote to memory of 3740 2124 4825.tmp 109 PID 2124 wrote to memory of 3740 2124 4825.tmp 109 PID 3740 wrote to memory of 4880 3740 48A2.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_9c3289f2ad717e1048543def5247b7bb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"23⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"24⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"25⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"26⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"27⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"28⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"29⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"30⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"31⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"32⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"33⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"34⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"35⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"36⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"37⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"38⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"39⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"40⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"41⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"42⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"43⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"44⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"45⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"46⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"47⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"48⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"49⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"50⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"51⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"52⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"53⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"54⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"55⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"56⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"57⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"58⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"59⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"60⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"61⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"62⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"63⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"64⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"65⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"66⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"67⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"68⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"69⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"70⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"71⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"72⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"73⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"74⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"75⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"76⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"77⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"78⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"79⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"80⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"81⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"82⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"83⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"85⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"86⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"87⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"88⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"89⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"90⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"91⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"92⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"93⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"94⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"95⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"96⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"98⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"99⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"100⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"101⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"102⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"103⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"104⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"106⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"107⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"108⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"109⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"110⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"111⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"112⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"113⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"114⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"115⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"116⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"117⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"118⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"119⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"120⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"121⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-