Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe
-
Size
541KB
-
MD5
540dd24e03cc22d1aa0c5758b8dc386c
-
SHA1
9fa2ee787fc6fedbcc729e211759218c0e9a9cbf
-
SHA256
65b0e2e144fa61af5d439b25b0ceb779f20310b2f9de9482b8c2074881ae2de1
-
SHA512
57009e515f0e5102cb602e5859bbc0f118bf05f232a7215406fb15fd6e1fa9454c5a9fb92e4371d871d5b4ceb4175e5c45b3eea6970e774792d81313cde5a384
-
SSDEEP
12288:UU5rCOTeifqwFvElcZk16FzwhtBc+JsrZa73ctO:UUQOJfyluk16F0DPJsrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
515C.tmp51D9.tmp5256.tmp5331.tmp53CD.tmp5488.tmp54F6.tmp5554.tmp561F.tmp567C.tmp5719.tmp57A5.tmp5813.tmp5870.tmp58DE.tmp595B.tmp59C8.tmp5A36.tmp5AD2.tmp5B4F.tmp5BBC.tmp5C68.tmp5CE5.tmp5D52.tmp5DCF.tmp5E5C.tmp5EC9.tmp5F37.tmp5FC3.tmp6021.tmp60AE.tmp610C.tmp6189.tmp61E6.tmp6244.tmp6292.tmp62F0.tmp633E.tmp639C.tmp63FA.tmp6448.tmp6496.tmp64F4.tmp6542.tmp659F.tmp65EE.tmp664B.tmp6699.tmp66F7.tmp6745.tmp67A3.tmp67F1.tmp684F.tmp689D.tmp68FB.tmp6959.tmp69B6.tmp6A14.tmp6A62.tmp6AB0.tmp6AFE.tmp6B5C.tmp6BAA.tmp6BF8.tmppid process 4136 515C.tmp 1424 51D9.tmp 3464 5256.tmp 4648 5331.tmp 4168 53CD.tmp 1504 5488.tmp 4576 54F6.tmp 4344 5554.tmp 1916 561F.tmp 2436 567C.tmp 3600 5719.tmp 876 57A5.tmp 4088 5813.tmp 4600 5870.tmp 2876 58DE.tmp 2520 595B.tmp 2404 59C8.tmp 1332 5A36.tmp 4696 5AD2.tmp 4784 5B4F.tmp 220 5BBC.tmp 2820 5C68.tmp 1248 5CE5.tmp 4692 5D52.tmp 2936 5DCF.tmp 1244 5E5C.tmp 5116 5EC9.tmp 4084 5F37.tmp 4548 5FC3.tmp 4980 6021.tmp 3776 60AE.tmp 4440 610C.tmp 1580 6189.tmp 2328 61E6.tmp 3948 6244.tmp 4768 6292.tmp 2400 62F0.tmp 912 633E.tmp 3648 639C.tmp 1364 63FA.tmp 1932 6448.tmp 1880 6496.tmp 1940 64F4.tmp 2472 6542.tmp 4420 659F.tmp 4948 65EE.tmp 4184 664B.tmp 2372 6699.tmp 3780 66F7.tmp 544 6745.tmp 1872 67A3.tmp 4676 67F1.tmp 4488 684F.tmp 3468 689D.tmp 4576 68FB.tmp 2600 6959.tmp 5092 69B6.tmp 5072 6A14.tmp 1496 6A62.tmp 1460 6AB0.tmp 2524 6AFE.tmp 3668 6B5C.tmp 3824 6BAA.tmp 1356 6BF8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe515C.tmp51D9.tmp5256.tmp5331.tmp53CD.tmp5488.tmp54F6.tmp5554.tmp561F.tmp567C.tmp5719.tmp57A5.tmp5813.tmp5870.tmp58DE.tmp595B.tmp59C8.tmp5A36.tmp5AD2.tmp5B4F.tmp5BBC.tmpdescription pid process target process PID 4248 wrote to memory of 4136 4248 2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe 515C.tmp PID 4248 wrote to memory of 4136 4248 2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe 515C.tmp PID 4248 wrote to memory of 4136 4248 2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe 515C.tmp PID 4136 wrote to memory of 1424 4136 515C.tmp 51D9.tmp PID 4136 wrote to memory of 1424 4136 515C.tmp 51D9.tmp PID 4136 wrote to memory of 1424 4136 515C.tmp 51D9.tmp PID 1424 wrote to memory of 3464 1424 51D9.tmp 5256.tmp PID 1424 wrote to memory of 3464 1424 51D9.tmp 5256.tmp PID 1424 wrote to memory of 3464 1424 51D9.tmp 5256.tmp PID 3464 wrote to memory of 4648 3464 5256.tmp 5331.tmp PID 3464 wrote to memory of 4648 3464 5256.tmp 5331.tmp PID 3464 wrote to memory of 4648 3464 5256.tmp 5331.tmp PID 4648 wrote to memory of 4168 4648 5331.tmp 53CD.tmp PID 4648 wrote to memory of 4168 4648 5331.tmp 53CD.tmp PID 4648 wrote to memory of 4168 4648 5331.tmp 53CD.tmp PID 4168 wrote to memory of 1504 4168 53CD.tmp 5488.tmp PID 4168 wrote to memory of 1504 4168 53CD.tmp 5488.tmp PID 4168 wrote to memory of 1504 4168 53CD.tmp 5488.tmp PID 1504 wrote to memory of 4576 1504 5488.tmp 54F6.tmp PID 1504 wrote to memory of 4576 1504 5488.tmp 54F6.tmp PID 1504 wrote to memory of 4576 1504 5488.tmp 54F6.tmp PID 4576 wrote to memory of 4344 4576 54F6.tmp 5554.tmp PID 4576 wrote to memory of 4344 4576 54F6.tmp 5554.tmp PID 4576 wrote to memory of 4344 4576 54F6.tmp 5554.tmp PID 4344 wrote to memory of 1916 4344 5554.tmp 561F.tmp PID 4344 wrote to memory of 1916 4344 5554.tmp 561F.tmp PID 4344 wrote to memory of 1916 4344 5554.tmp 561F.tmp PID 1916 wrote to memory of 2436 1916 561F.tmp 567C.tmp PID 1916 wrote to memory of 2436 1916 561F.tmp 567C.tmp PID 1916 wrote to memory of 2436 1916 561F.tmp 567C.tmp PID 2436 wrote to memory of 3600 2436 567C.tmp 5719.tmp PID 2436 wrote to memory of 3600 2436 567C.tmp 5719.tmp PID 2436 wrote to memory of 3600 2436 567C.tmp 5719.tmp PID 3600 wrote to memory of 876 3600 5719.tmp 57A5.tmp PID 3600 wrote to memory of 876 3600 5719.tmp 57A5.tmp PID 3600 wrote to memory of 876 3600 5719.tmp 57A5.tmp PID 876 wrote to memory of 4088 876 57A5.tmp 5813.tmp PID 876 wrote to memory of 4088 876 57A5.tmp 5813.tmp PID 876 wrote to memory of 4088 876 57A5.tmp 5813.tmp PID 4088 wrote to memory of 4600 4088 5813.tmp 5870.tmp PID 4088 wrote to memory of 4600 4088 5813.tmp 5870.tmp PID 4088 wrote to memory of 4600 4088 5813.tmp 5870.tmp PID 4600 wrote to memory of 2876 4600 5870.tmp 58DE.tmp PID 4600 wrote to memory of 2876 4600 5870.tmp 58DE.tmp PID 4600 wrote to memory of 2876 4600 5870.tmp 58DE.tmp PID 2876 wrote to memory of 2520 2876 58DE.tmp 595B.tmp PID 2876 wrote to memory of 2520 2876 58DE.tmp 595B.tmp PID 2876 wrote to memory of 2520 2876 58DE.tmp 595B.tmp PID 2520 wrote to memory of 2404 2520 595B.tmp 59C8.tmp PID 2520 wrote to memory of 2404 2520 595B.tmp 59C8.tmp PID 2520 wrote to memory of 2404 2520 595B.tmp 59C8.tmp PID 2404 wrote to memory of 1332 2404 59C8.tmp 5A36.tmp PID 2404 wrote to memory of 1332 2404 59C8.tmp 5A36.tmp PID 2404 wrote to memory of 1332 2404 59C8.tmp 5A36.tmp PID 1332 wrote to memory of 4696 1332 5A36.tmp 5AD2.tmp PID 1332 wrote to memory of 4696 1332 5A36.tmp 5AD2.tmp PID 1332 wrote to memory of 4696 1332 5A36.tmp 5AD2.tmp PID 4696 wrote to memory of 4784 4696 5AD2.tmp 5B4F.tmp PID 4696 wrote to memory of 4784 4696 5AD2.tmp 5B4F.tmp PID 4696 wrote to memory of 4784 4696 5AD2.tmp 5B4F.tmp PID 4784 wrote to memory of 220 4784 5B4F.tmp 5BBC.tmp PID 4784 wrote to memory of 220 4784 5B4F.tmp 5BBC.tmp PID 4784 wrote to memory of 220 4784 5B4F.tmp 5BBC.tmp PID 220 wrote to memory of 2820 220 5BBC.tmp 5C68.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_540dd24e03cc22d1aa0c5758b8dc386c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"23⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"24⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"25⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"26⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"27⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"28⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"29⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"30⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"31⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"32⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"33⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"34⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"35⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"36⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"37⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"38⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"39⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"40⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"41⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"42⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"43⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"44⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"45⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"46⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"47⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"48⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"49⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"50⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"51⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"52⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"53⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"54⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"55⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"56⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"57⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"58⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"59⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"60⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"61⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"62⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"63⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"64⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"65⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"66⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"67⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"68⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"69⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"71⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"72⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"73⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"74⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"75⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"76⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"77⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"78⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"79⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"81⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"82⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"83⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"84⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"85⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"86⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"87⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"88⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"89⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"90⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"91⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"92⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"93⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"94⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"95⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"96⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"97⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"98⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"99⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"100⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"101⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"102⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"103⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"104⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"105⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"106⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"107⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"108⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"109⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"110⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"111⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"112⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"113⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"114⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"115⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"116⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"117⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"118⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"119⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"120⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"121⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"122⤵PID:1012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-