Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
-
Size
527KB
-
MD5
969fa81aabded50ed9d9a85e110938a4
-
SHA1
b691964ef0c25ac8d303b4737bee802a483bdf4c
-
SHA256
65d50064054ff47d76f4c7dffafdb664d617c8c7de547719e7c415f00f324bb0
-
SHA512
4c23e9b74bbaa807395c59c01ac1eb506aa196913064795e15f018f219100a061bdee142ff6160507f4bb0ffac6f313da2ed314340987c0d3857b0950a6f2e57
-
SSDEEP
12288:fU5rCOTeidy35Z4CgkEX67L7wYoifk9DZu:fUQOJdy2X67PwYw9Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2068 5FB4.tmp 2968 6031.tmp 4628 60BD.tmp 2748 612B.tmp 5008 61B7.tmp 1864 6206.tmp 3732 6283.tmp 4116 62E0.tmp 2536 634E.tmp 2148 63AB.tmp 2576 63FA.tmp 432 6467.tmp 4200 64E4.tmp 4388 6542.tmp 4652 659F.tmp 3712 660D.tmp 2192 66A9.tmp 1612 6707.tmp 1756 6755.tmp 4924 67C2.tmp 1592 6830.tmp 4656 68BC.tmp 3328 690A.tmp 1396 6987.tmp 4992 69E5.tmp 4044 6A53.tmp 1416 6AD0.tmp 3252 6B2D.tmp 3164 6B7B.tmp 3564 6BE9.tmp 3136 6C37.tmp 4940 6C95.tmp 4468 6CE3.tmp 3520 6D31.tmp 2472 6D7F.tmp 4580 6DDD.tmp 3996 6E3B.tmp 4452 6EA8.tmp 3748 6EF6.tmp 3772 6F44.tmp 2144 6F92.tmp 2136 6FE0.tmp 1336 703E.tmp 400 709C.tmp 4504 70EA.tmp 3744 7138.tmp 2112 7186.tmp 5096 71D4.tmp 1168 7223.tmp 2692 7271.tmp 4620 72BF.tmp 3028 730D.tmp 4368 735B.tmp 4380 73A9.tmp 1468 73F7.tmp 3672 7455.tmp 2204 74A3.tmp 1776 7501.tmp 4996 754F.tmp 2348 759D.tmp 3372 75EB.tmp 4628 7639.tmp 1436 7688.tmp 4752 76C6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 2068 1004 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 81 PID 1004 wrote to memory of 2068 1004 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 81 PID 1004 wrote to memory of 2068 1004 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 81 PID 2068 wrote to memory of 2968 2068 5FB4.tmp 82 PID 2068 wrote to memory of 2968 2068 5FB4.tmp 82 PID 2068 wrote to memory of 2968 2068 5FB4.tmp 82 PID 2968 wrote to memory of 4628 2968 6031.tmp 83 PID 2968 wrote to memory of 4628 2968 6031.tmp 83 PID 2968 wrote to memory of 4628 2968 6031.tmp 83 PID 4628 wrote to memory of 2748 4628 60BD.tmp 84 PID 4628 wrote to memory of 2748 4628 60BD.tmp 84 PID 4628 wrote to memory of 2748 4628 60BD.tmp 84 PID 2748 wrote to memory of 5008 2748 612B.tmp 85 PID 2748 wrote to memory of 5008 2748 612B.tmp 85 PID 2748 wrote to memory of 5008 2748 612B.tmp 85 PID 5008 wrote to memory of 1864 5008 61B7.tmp 86 PID 5008 wrote to memory of 1864 5008 61B7.tmp 86 PID 5008 wrote to memory of 1864 5008 61B7.tmp 86 PID 1864 wrote to memory of 3732 1864 6206.tmp 87 PID 1864 wrote to memory of 3732 1864 6206.tmp 87 PID 1864 wrote to memory of 3732 1864 6206.tmp 87 PID 3732 wrote to memory of 4116 3732 6283.tmp 88 PID 3732 wrote to memory of 4116 3732 6283.tmp 88 PID 3732 wrote to memory of 4116 3732 6283.tmp 88 PID 4116 wrote to memory of 2536 4116 62E0.tmp 89 PID 4116 wrote to memory of 2536 4116 62E0.tmp 89 PID 4116 wrote to memory of 2536 4116 62E0.tmp 89 PID 2536 wrote to memory of 2148 2536 634E.tmp 90 PID 2536 wrote to memory of 2148 2536 634E.tmp 90 PID 2536 wrote to memory of 2148 2536 634E.tmp 90 PID 2148 wrote to memory of 2576 2148 63AB.tmp 91 PID 2148 wrote to memory of 2576 2148 63AB.tmp 91 PID 2148 wrote to memory of 2576 2148 63AB.tmp 91 PID 2576 wrote to memory of 432 2576 63FA.tmp 92 PID 2576 wrote to memory of 432 2576 63FA.tmp 92 PID 2576 wrote to memory of 432 2576 63FA.tmp 92 PID 432 wrote to memory of 4200 432 6467.tmp 93 PID 432 wrote to memory of 4200 432 6467.tmp 93 PID 432 wrote to memory of 4200 432 6467.tmp 93 PID 4200 wrote to memory of 4388 4200 64E4.tmp 94 PID 4200 wrote to memory of 4388 4200 64E4.tmp 94 PID 4200 wrote to memory of 4388 4200 64E4.tmp 94 PID 4388 wrote to memory of 4652 4388 6542.tmp 95 PID 4388 wrote to memory of 4652 4388 6542.tmp 95 PID 4388 wrote to memory of 4652 4388 6542.tmp 95 PID 4652 wrote to memory of 3712 4652 659F.tmp 96 PID 4652 wrote to memory of 3712 4652 659F.tmp 96 PID 4652 wrote to memory of 3712 4652 659F.tmp 96 PID 3712 wrote to memory of 2192 3712 660D.tmp 97 PID 3712 wrote to memory of 2192 3712 660D.tmp 97 PID 3712 wrote to memory of 2192 3712 660D.tmp 97 PID 2192 wrote to memory of 1612 2192 66A9.tmp 98 PID 2192 wrote to memory of 1612 2192 66A9.tmp 98 PID 2192 wrote to memory of 1612 2192 66A9.tmp 98 PID 1612 wrote to memory of 1756 1612 6707.tmp 99 PID 1612 wrote to memory of 1756 1612 6707.tmp 99 PID 1612 wrote to memory of 1756 1612 6707.tmp 99 PID 1756 wrote to memory of 4924 1756 6755.tmp 100 PID 1756 wrote to memory of 4924 1756 6755.tmp 100 PID 1756 wrote to memory of 4924 1756 6755.tmp 100 PID 4924 wrote to memory of 1592 4924 67C2.tmp 103 PID 4924 wrote to memory of 1592 4924 67C2.tmp 103 PID 4924 wrote to memory of 1592 4924 67C2.tmp 103 PID 1592 wrote to memory of 4656 1592 6830.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"23⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"24⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"25⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"26⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"27⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"28⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"29⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"30⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"31⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"32⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"33⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"34⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"35⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"36⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"37⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"38⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"39⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"40⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"41⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"42⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"43⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"44⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"45⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"46⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"47⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"48⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"49⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"50⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"51⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"52⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"53⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"54⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"55⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"56⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"57⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"58⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"59⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"60⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"61⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"62⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"64⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"65⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"66⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"67⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"68⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"69⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"70⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"71⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"72⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"73⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"74⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"75⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"76⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"77⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"78⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"79⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"80⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"81⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"82⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"83⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"84⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"85⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"86⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"88⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"89⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"90⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"91⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"92⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"93⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"94⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"95⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"96⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"97⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"98⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"99⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"100⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"101⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"102⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"103⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"104⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"105⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"106⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"107⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"108⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"109⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"110⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"111⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"112⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"113⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"114⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"115⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"116⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"117⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"118⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"119⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"120⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"121⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-