Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe
-
Size
520KB
-
MD5
14c7e1884b110b1928ce7e430b2c631c
-
SHA1
44d839755f82e621411962ed6c313ebb68584544
-
SHA256
2ce7449752b1b35c7b63301a829256ba631f0d0adecb10c6ebde45a60a2c1c9b
-
SHA512
abad7b7f0e8b705b4b950e283997dc272d00e1e94c2631854e8b6db154e54c13fba5706bee74bc31388d5143fc1b8ee7b1591fb7baf214b37b55cf6e0e347e84
-
SSDEEP
12288:gj8fuxR21t5i8fKbA1oUvKkbCiIR8KNZ:gj8fuK1GYUA1fNILN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
44D9.tmp4575.tmp4602.tmp466F.tmp46FC.tmp4779.tmp47C7.tmp4815.tmp4882.tmp48FF.tmp497C.tmp49F9.tmp4A47.tmp4AD4.tmp4B41.tmp4B90.tmp4BED.tmp4C4B.tmp4CA9.tmp4D35.tmp4D93.tmp4DF1.tmp4E4F.tmp4ECC.tmp4F39.tmp4FA6.tmp5014.tmp5072.tmp50DF.tmp514C.tmp51AA.tmp5237.tmp5294.tmp52E3.tmp5331.tmp538E.tmp53FC.tmp544A.tmp5498.tmp54E6.tmp5534.tmp5592.tmp55F0.tmp563E.tmp568C.tmp56DA.tmp5728.tmp5776.tmp57D4.tmp5822.tmp5870.tmp58BF.tmp590D.tmp595B.tmp59B9.tmp5A07.tmp5A64.tmp5AC2.tmp5B10.tmp5B6E.tmp5BBC.tmp5C1A.tmp5C78.tmp5CD5.tmppid process 1676 44D9.tmp 4788 4575.tmp 956 4602.tmp 2460 466F.tmp 4992 46FC.tmp 2104 4779.tmp 3740 47C7.tmp 2084 4815.tmp 2620 4882.tmp 2372 48FF.tmp 1488 497C.tmp 4872 49F9.tmp 2740 4A47.tmp 2256 4AD4.tmp 2800 4B41.tmp 4036 4B90.tmp 1120 4BED.tmp 1104 4C4B.tmp 1856 4CA9.tmp 2768 4D35.tmp 4996 4D93.tmp 2904 4DF1.tmp 1532 4E4F.tmp 4888 4ECC.tmp 3408 4F39.tmp 3564 4FA6.tmp 1968 5014.tmp 3884 5072.tmp 4312 50DF.tmp 4432 514C.tmp 1516 51AA.tmp 4736 5237.tmp 1692 5294.tmp 4968 52E3.tmp 4852 5331.tmp 2380 538E.tmp 2460 53FC.tmp 3780 544A.tmp 1584 5498.tmp 3944 54E6.tmp 100 5534.tmp 4928 5592.tmp 4088 55F0.tmp 392 563E.tmp 3184 568C.tmp 3656 56DA.tmp 2792 5728.tmp 852 5776.tmp 1740 57D4.tmp 3912 5822.tmp 2800 5870.tmp 3144 58BF.tmp 1496 590D.tmp 1120 595B.tmp 2072 59B9.tmp 780 5A07.tmp 1576 5A64.tmp 2852 5AC2.tmp 764 5B10.tmp 5028 5B6E.tmp 528 5BBC.tmp 1532 5C1A.tmp 2488 5C78.tmp 3764 5CD5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe44D9.tmp4575.tmp4602.tmp466F.tmp46FC.tmp4779.tmp47C7.tmp4815.tmp4882.tmp48FF.tmp497C.tmp49F9.tmp4A47.tmp4AD4.tmp4B41.tmp4B90.tmp4BED.tmp4C4B.tmp4CA9.tmp4D35.tmp4D93.tmpdescription pid process target process PID 5108 wrote to memory of 1676 5108 2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe 44D9.tmp PID 5108 wrote to memory of 1676 5108 2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe 44D9.tmp PID 5108 wrote to memory of 1676 5108 2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe 44D9.tmp PID 1676 wrote to memory of 4788 1676 44D9.tmp 4575.tmp PID 1676 wrote to memory of 4788 1676 44D9.tmp 4575.tmp PID 1676 wrote to memory of 4788 1676 44D9.tmp 4575.tmp PID 4788 wrote to memory of 956 4788 4575.tmp 4602.tmp PID 4788 wrote to memory of 956 4788 4575.tmp 4602.tmp PID 4788 wrote to memory of 956 4788 4575.tmp 4602.tmp PID 956 wrote to memory of 2460 956 4602.tmp 466F.tmp PID 956 wrote to memory of 2460 956 4602.tmp 466F.tmp PID 956 wrote to memory of 2460 956 4602.tmp 466F.tmp PID 2460 wrote to memory of 4992 2460 466F.tmp 46FC.tmp PID 2460 wrote to memory of 4992 2460 466F.tmp 46FC.tmp PID 2460 wrote to memory of 4992 2460 466F.tmp 46FC.tmp PID 4992 wrote to memory of 2104 4992 46FC.tmp 4779.tmp PID 4992 wrote to memory of 2104 4992 46FC.tmp 4779.tmp PID 4992 wrote to memory of 2104 4992 46FC.tmp 4779.tmp PID 2104 wrote to memory of 3740 2104 4779.tmp 47C7.tmp PID 2104 wrote to memory of 3740 2104 4779.tmp 47C7.tmp PID 2104 wrote to memory of 3740 2104 4779.tmp 47C7.tmp PID 3740 wrote to memory of 2084 3740 47C7.tmp 4815.tmp PID 3740 wrote to memory of 2084 3740 47C7.tmp 4815.tmp PID 3740 wrote to memory of 2084 3740 47C7.tmp 4815.tmp PID 2084 wrote to memory of 2620 2084 4815.tmp 4882.tmp PID 2084 wrote to memory of 2620 2084 4815.tmp 4882.tmp PID 2084 wrote to memory of 2620 2084 4815.tmp 4882.tmp PID 2620 wrote to memory of 2372 2620 4882.tmp 48FF.tmp PID 2620 wrote to memory of 2372 2620 4882.tmp 48FF.tmp PID 2620 wrote to memory of 2372 2620 4882.tmp 48FF.tmp PID 2372 wrote to memory of 1488 2372 48FF.tmp 497C.tmp PID 2372 wrote to memory of 1488 2372 48FF.tmp 497C.tmp PID 2372 wrote to memory of 1488 2372 48FF.tmp 497C.tmp PID 1488 wrote to memory of 4872 1488 497C.tmp 49F9.tmp PID 1488 wrote to memory of 4872 1488 497C.tmp 49F9.tmp PID 1488 wrote to memory of 4872 1488 497C.tmp 49F9.tmp PID 4872 wrote to memory of 2740 4872 49F9.tmp 4A47.tmp PID 4872 wrote to memory of 2740 4872 49F9.tmp 4A47.tmp PID 4872 wrote to memory of 2740 4872 49F9.tmp 4A47.tmp PID 2740 wrote to memory of 2256 2740 4A47.tmp 4AD4.tmp PID 2740 wrote to memory of 2256 2740 4A47.tmp 4AD4.tmp PID 2740 wrote to memory of 2256 2740 4A47.tmp 4AD4.tmp PID 2256 wrote to memory of 2800 2256 4AD4.tmp 4B41.tmp PID 2256 wrote to memory of 2800 2256 4AD4.tmp 4B41.tmp PID 2256 wrote to memory of 2800 2256 4AD4.tmp 4B41.tmp PID 2800 wrote to memory of 4036 2800 4B41.tmp 4B90.tmp PID 2800 wrote to memory of 4036 2800 4B41.tmp 4B90.tmp PID 2800 wrote to memory of 4036 2800 4B41.tmp 4B90.tmp PID 4036 wrote to memory of 1120 4036 4B90.tmp 4BED.tmp PID 4036 wrote to memory of 1120 4036 4B90.tmp 4BED.tmp PID 4036 wrote to memory of 1120 4036 4B90.tmp 4BED.tmp PID 1120 wrote to memory of 1104 1120 4BED.tmp 4C4B.tmp PID 1120 wrote to memory of 1104 1120 4BED.tmp 4C4B.tmp PID 1120 wrote to memory of 1104 1120 4BED.tmp 4C4B.tmp PID 1104 wrote to memory of 1856 1104 4C4B.tmp 4CA9.tmp PID 1104 wrote to memory of 1856 1104 4C4B.tmp 4CA9.tmp PID 1104 wrote to memory of 1856 1104 4C4B.tmp 4CA9.tmp PID 1856 wrote to memory of 2768 1856 4CA9.tmp 4D35.tmp PID 1856 wrote to memory of 2768 1856 4CA9.tmp 4D35.tmp PID 1856 wrote to memory of 2768 1856 4CA9.tmp 4D35.tmp PID 2768 wrote to memory of 4996 2768 4D35.tmp 4D93.tmp PID 2768 wrote to memory of 4996 2768 4D35.tmp 4D93.tmp PID 2768 wrote to memory of 4996 2768 4D35.tmp 4D93.tmp PID 4996 wrote to memory of 2904 4996 4D93.tmp 4DF1.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_14c7e1884b110b1928ce7e430b2c631c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"23⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"24⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"25⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"26⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"27⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"28⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"29⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"30⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"31⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"32⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"33⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"34⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"35⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"36⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"37⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"38⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"39⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"40⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"41⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"42⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"43⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"44⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"45⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"46⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"47⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"48⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"49⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"50⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"51⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"52⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"53⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"54⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"55⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"56⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"57⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"58⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"59⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"60⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"61⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"62⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"63⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"64⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"65⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"66⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"67⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"68⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"69⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"70⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"71⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"72⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"73⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"74⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"75⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"76⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"77⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"78⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"79⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"80⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"81⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"82⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"83⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"84⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"85⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"86⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"87⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"88⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"89⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"90⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"91⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"92⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"93⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"94⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"95⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"96⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"97⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"98⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"99⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"100⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"101⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"102⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"103⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"104⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"105⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"106⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"107⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"108⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"109⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"110⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"111⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"112⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"113⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"114⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"115⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"116⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"117⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"118⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"119⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"120⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"121⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-