Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
-
Size
529KB
-
MD5
42f7c202b0c0764a2cbf826dfb673c9a
-
SHA1
7406957e1e932bc7b84f604788585a125bf3e045
-
SHA256
ae6d4cb94059bef595e8eb463f73e846186da312954849f8d3b1d6dc7ffaaa2e
-
SHA512
23bc087c468879dbabb337a4f294695feff6cd6c3e2818cc7eb007c8731c91d490a29026822610b36c9b556f99d5b3ee619ff0c139f46f8d203c0284894d6cdd
-
SSDEEP
12288:NU5rCOTeijgvNaPKGNIzzftoOBCa/JwuKbTZwlH4Hp:NUQOJjgVaIftoir/JhKbTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 60 41FA.tmp 4712 4287.tmp 4044 42F4.tmp 2104 4381.tmp 1436 43EE.tmp 3692 445C.tmp 2672 44C9.tmp 3040 4537.tmp 2044 45B4.tmp 1232 4621.tmp 3216 469E.tmp 4228 46FC.tmp 2572 4769.tmp 5008 47E6.tmp 4764 4844.tmp 3268 48B1.tmp 632 490F.tmp 4932 499C.tmp 1744 4A19.tmp 4904 4AA5.tmp 2588 4B13.tmp 2920 4B80.tmp 2292 4C0D.tmp 3876 4C7A.tmp 2100 4CE7.tmp 1752 4D64.tmp 3468 4DF1.tmp 1828 4E5E.tmp 2468 4EDB.tmp 1888 4F68.tmp 4176 4FB6.tmp 3236 5052.tmp 5060 50DF.tmp 512 517B.tmp 1080 51C9.tmp 2356 5217.tmp 4788 5266.tmp 4936 52C3.tmp 1436 5321.tmp 516 537F.tmp 3076 53DD.tmp 2672 543A.tmp 3040 5498.tmp 3096 54F6.tmp 1784 5554.tmp 2952 55B1.tmp 3188 560F.tmp 2684 566D.tmp 3216 56CB.tmp 1456 5719.tmp 2220 5776.tmp 2572 57D4.tmp 2936 5832.tmp 4540 5890.tmp 4764 58ED.tmp 4672 594B.tmp 4952 59A9.tmp 4532 5A07.tmp 2620 5A64.tmp 1952 5AD2.tmp 4804 5B30.tmp 4964 5B8D.tmp 1576 5BEB.tmp 2324 5C49.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 60 4256 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 83 PID 4256 wrote to memory of 60 4256 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 83 PID 4256 wrote to memory of 60 4256 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 83 PID 60 wrote to memory of 4712 60 41FA.tmp 84 PID 60 wrote to memory of 4712 60 41FA.tmp 84 PID 60 wrote to memory of 4712 60 41FA.tmp 84 PID 4712 wrote to memory of 4044 4712 4287.tmp 85 PID 4712 wrote to memory of 4044 4712 4287.tmp 85 PID 4712 wrote to memory of 4044 4712 4287.tmp 85 PID 4044 wrote to memory of 2104 4044 42F4.tmp 87 PID 4044 wrote to memory of 2104 4044 42F4.tmp 87 PID 4044 wrote to memory of 2104 4044 42F4.tmp 87 PID 2104 wrote to memory of 1436 2104 4381.tmp 88 PID 2104 wrote to memory of 1436 2104 4381.tmp 88 PID 2104 wrote to memory of 1436 2104 4381.tmp 88 PID 1436 wrote to memory of 3692 1436 43EE.tmp 89 PID 1436 wrote to memory of 3692 1436 43EE.tmp 89 PID 1436 wrote to memory of 3692 1436 43EE.tmp 89 PID 3692 wrote to memory of 2672 3692 445C.tmp 91 PID 3692 wrote to memory of 2672 3692 445C.tmp 91 PID 3692 wrote to memory of 2672 3692 445C.tmp 91 PID 2672 wrote to memory of 3040 2672 44C9.tmp 92 PID 2672 wrote to memory of 3040 2672 44C9.tmp 92 PID 2672 wrote to memory of 3040 2672 44C9.tmp 92 PID 3040 wrote to memory of 2044 3040 4537.tmp 93 PID 3040 wrote to memory of 2044 3040 4537.tmp 93 PID 3040 wrote to memory of 2044 3040 4537.tmp 93 PID 2044 wrote to memory of 1232 2044 45B4.tmp 94 PID 2044 wrote to memory of 1232 2044 45B4.tmp 94 PID 2044 wrote to memory of 1232 2044 45B4.tmp 94 PID 1232 wrote to memory of 3216 1232 4621.tmp 96 PID 1232 wrote to memory of 3216 1232 4621.tmp 96 PID 1232 wrote to memory of 3216 1232 4621.tmp 96 PID 3216 wrote to memory of 4228 3216 469E.tmp 97 PID 3216 wrote to memory of 4228 3216 469E.tmp 97 PID 3216 wrote to memory of 4228 3216 469E.tmp 97 PID 4228 wrote to memory of 2572 4228 46FC.tmp 98 PID 4228 wrote to memory of 2572 4228 46FC.tmp 98 PID 4228 wrote to memory of 2572 4228 46FC.tmp 98 PID 2572 wrote to memory of 5008 2572 4769.tmp 99 PID 2572 wrote to memory of 5008 2572 4769.tmp 99 PID 2572 wrote to memory of 5008 2572 4769.tmp 99 PID 5008 wrote to memory of 4764 5008 47E6.tmp 100 PID 5008 wrote to memory of 4764 5008 47E6.tmp 100 PID 5008 wrote to memory of 4764 5008 47E6.tmp 100 PID 4764 wrote to memory of 3268 4764 4844.tmp 101 PID 4764 wrote to memory of 3268 4764 4844.tmp 101 PID 4764 wrote to memory of 3268 4764 4844.tmp 101 PID 3268 wrote to memory of 632 3268 48B1.tmp 102 PID 3268 wrote to memory of 632 3268 48B1.tmp 102 PID 3268 wrote to memory of 632 3268 48B1.tmp 102 PID 632 wrote to memory of 4932 632 490F.tmp 103 PID 632 wrote to memory of 4932 632 490F.tmp 103 PID 632 wrote to memory of 4932 632 490F.tmp 103 PID 4932 wrote to memory of 1744 4932 499C.tmp 104 PID 4932 wrote to memory of 1744 4932 499C.tmp 104 PID 4932 wrote to memory of 1744 4932 499C.tmp 104 PID 1744 wrote to memory of 4904 1744 4A19.tmp 106 PID 1744 wrote to memory of 4904 1744 4A19.tmp 106 PID 1744 wrote to memory of 4904 1744 4A19.tmp 106 PID 4904 wrote to memory of 2588 4904 4AA5.tmp 107 PID 4904 wrote to memory of 2588 4904 4AA5.tmp 107 PID 4904 wrote to memory of 2588 4904 4AA5.tmp 107 PID 2588 wrote to memory of 2920 2588 4B13.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"23⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"24⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"25⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"26⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"27⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"28⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"29⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"30⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"31⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"32⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"33⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"34⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"35⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"36⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"37⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"38⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"39⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"40⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"41⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"42⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"43⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"44⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"45⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"46⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"47⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"48⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"49⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"50⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"51⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"52⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"53⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"54⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"55⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"56⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"57⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"58⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"59⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"60⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"61⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"62⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"63⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"64⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"65⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"66⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"67⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"68⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"69⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"70⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"71⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"72⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"73⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"74⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"75⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"76⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"77⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"78⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"79⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"80⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"81⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"82⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"83⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"84⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"85⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"86⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"87⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"88⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"89⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"90⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"91⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"92⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"94⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"95⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"96⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"97⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"98⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"99⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"100⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"101⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"102⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"103⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"104⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"105⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"106⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"107⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"108⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"109⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"110⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"111⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"112⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"113⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"114⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"115⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"116⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"117⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"118⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"119⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"120⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"121⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"122⤵PID:780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-