Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe
-
Size
527KB
-
MD5
62712fee693808620ed6d08b26148cbc
-
SHA1
46e784c090124d1aa99880d8610c22660012af10
-
SHA256
3d9c185f0c8e1425955e47d1188b1bda0210d90ad778e8a5009747a1f0c5794e
-
SHA512
2d6c45877cbcaf3b849083f6bf3920ec54d418a2d113196b9e0285cb627ea6232176c64d6a5df55383e7034049d2ab6a2e48ee8b5582d876bed289660ae389b5
-
SSDEEP
12288:fU5rCOTeidq21ucP1tOyCVlYHMxhWN6/uNDZu:fUQOJdqetZCWMH3QDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4936 68BC.tmp 2320 6949.tmp 2396 69D6.tmp 2140 6A62.tmp 4552 6AD0.tmp 4592 6B2D.tmp 3988 6B8B.tmp 4748 6BD9.tmp 2468 6C37.tmp 3312 6CA4.tmp 4256 6D12.tmp 2072 6D7F.tmp 1432 6DEC.tmp 4772 6E5A.tmp 4512 6EC7.tmp 464 6F15.tmp 2940 6F92.tmp 4040 702F.tmp 1976 707D.tmp 5036 70FA.tmp 2212 7148.tmp 2316 71D4.tmp 4712 7251.tmp 4504 72AF.tmp 4568 731D.tmp 1948 738A.tmp 4788 73F7.tmp 4048 7474.tmp 4108 74E2.tmp 4196 753F.tmp 1284 75AD.tmp 5024 761A.tmp 4460 7688.tmp 620 7714.tmp 1272 7772.tmp 1544 77C0.tmp 4808 780E.tmp 3488 786C.tmp 4428 78CA.tmp 2108 7927.tmp 3312 7985.tmp 4920 79D3.tmp 840 7A41.tmp 5016 7A9E.tmp 4484 7AED.tmp 4036 7B4A.tmp 860 7BA8.tmp 1592 7C06.tmp 4336 7C54.tmp 844 7CA2.tmp 1816 7D00.tmp 1152 7D5E.tmp 2052 7DBB.tmp 4080 7E09.tmp 5036 7E58.tmp 384 7EA6.tmp 2456 7F03.tmp 4980 7F52.tmp 2780 7FAF.tmp 3328 7FFD.tmp 2896 804C.tmp 3984 80A9.tmp 1580 80F7.tmp 928 8155.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4936 4092 2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe 85 PID 4092 wrote to memory of 4936 4092 2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe 85 PID 4092 wrote to memory of 4936 4092 2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe 85 PID 4936 wrote to memory of 2320 4936 68BC.tmp 86 PID 4936 wrote to memory of 2320 4936 68BC.tmp 86 PID 4936 wrote to memory of 2320 4936 68BC.tmp 86 PID 2320 wrote to memory of 2396 2320 6949.tmp 88 PID 2320 wrote to memory of 2396 2320 6949.tmp 88 PID 2320 wrote to memory of 2396 2320 6949.tmp 88 PID 2396 wrote to memory of 2140 2396 69D6.tmp 90 PID 2396 wrote to memory of 2140 2396 69D6.tmp 90 PID 2396 wrote to memory of 2140 2396 69D6.tmp 90 PID 2140 wrote to memory of 4552 2140 6A62.tmp 92 PID 2140 wrote to memory of 4552 2140 6A62.tmp 92 PID 2140 wrote to memory of 4552 2140 6A62.tmp 92 PID 4552 wrote to memory of 4592 4552 6AD0.tmp 93 PID 4552 wrote to memory of 4592 4552 6AD0.tmp 93 PID 4552 wrote to memory of 4592 4552 6AD0.tmp 93 PID 4592 wrote to memory of 3988 4592 6B2D.tmp 94 PID 4592 wrote to memory of 3988 4592 6B2D.tmp 94 PID 4592 wrote to memory of 3988 4592 6B2D.tmp 94 PID 3988 wrote to memory of 4748 3988 6B8B.tmp 95 PID 3988 wrote to memory of 4748 3988 6B8B.tmp 95 PID 3988 wrote to memory of 4748 3988 6B8B.tmp 95 PID 4748 wrote to memory of 2468 4748 6BD9.tmp 96 PID 4748 wrote to memory of 2468 4748 6BD9.tmp 96 PID 4748 wrote to memory of 2468 4748 6BD9.tmp 96 PID 2468 wrote to memory of 3312 2468 6C37.tmp 97 PID 2468 wrote to memory of 3312 2468 6C37.tmp 97 PID 2468 wrote to memory of 3312 2468 6C37.tmp 97 PID 3312 wrote to memory of 4256 3312 6CA4.tmp 98 PID 3312 wrote to memory of 4256 3312 6CA4.tmp 98 PID 3312 wrote to memory of 4256 3312 6CA4.tmp 98 PID 4256 wrote to memory of 2072 4256 6D12.tmp 99 PID 4256 wrote to memory of 2072 4256 6D12.tmp 99 PID 4256 wrote to memory of 2072 4256 6D12.tmp 99 PID 2072 wrote to memory of 1432 2072 6D7F.tmp 100 PID 2072 wrote to memory of 1432 2072 6D7F.tmp 100 PID 2072 wrote to memory of 1432 2072 6D7F.tmp 100 PID 1432 wrote to memory of 4772 1432 6DEC.tmp 101 PID 1432 wrote to memory of 4772 1432 6DEC.tmp 101 PID 1432 wrote to memory of 4772 1432 6DEC.tmp 101 PID 4772 wrote to memory of 4512 4772 6E5A.tmp 102 PID 4772 wrote to memory of 4512 4772 6E5A.tmp 102 PID 4772 wrote to memory of 4512 4772 6E5A.tmp 102 PID 4512 wrote to memory of 464 4512 6EC7.tmp 103 PID 4512 wrote to memory of 464 4512 6EC7.tmp 103 PID 4512 wrote to memory of 464 4512 6EC7.tmp 103 PID 464 wrote to memory of 2940 464 6F15.tmp 104 PID 464 wrote to memory of 2940 464 6F15.tmp 104 PID 464 wrote to memory of 2940 464 6F15.tmp 104 PID 2940 wrote to memory of 4040 2940 6F92.tmp 105 PID 2940 wrote to memory of 4040 2940 6F92.tmp 105 PID 2940 wrote to memory of 4040 2940 6F92.tmp 105 PID 4040 wrote to memory of 1976 4040 702F.tmp 106 PID 4040 wrote to memory of 1976 4040 702F.tmp 106 PID 4040 wrote to memory of 1976 4040 702F.tmp 106 PID 1976 wrote to memory of 5036 1976 707D.tmp 107 PID 1976 wrote to memory of 5036 1976 707D.tmp 107 PID 1976 wrote to memory of 5036 1976 707D.tmp 107 PID 5036 wrote to memory of 2212 5036 70FA.tmp 108 PID 5036 wrote to memory of 2212 5036 70FA.tmp 108 PID 5036 wrote to memory of 2212 5036 70FA.tmp 108 PID 2212 wrote to memory of 2316 2212 7148.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_62712fee693808620ed6d08b26148cbc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"23⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"24⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"25⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"26⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"27⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"28⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"29⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"30⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"31⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"32⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"33⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"34⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"35⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"36⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"37⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"38⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"39⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"41⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"42⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"43⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"44⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"45⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"46⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"47⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"48⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"49⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"50⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"51⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"52⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"53⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"54⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"55⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"56⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"57⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"58⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"59⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"60⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"61⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"62⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"63⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"64⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"65⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"66⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"67⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"68⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"69⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"70⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"71⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"72⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"73⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"74⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"75⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"76⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"77⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"78⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"79⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"80⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"81⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"82⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"83⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"84⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"85⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"86⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"87⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"88⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"89⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"90⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"91⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"92⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"93⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"94⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"95⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"96⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"97⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"98⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"99⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"100⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"101⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"102⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"103⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"104⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"105⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"106⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"108⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"109⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"110⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"111⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"112⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"113⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"114⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"115⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"116⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"117⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"118⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"119⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"120⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"121⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-