Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe
-
Size
712KB
-
MD5
1426137a6d0361d5e483c7c6cf1702d6
-
SHA1
41c005b9f092fe42d871003eeba23bf9155aa0b6
-
SHA256
3b3589d6b1d792c45f415789309a0278da061dff36934f13d05c0f3d202aa948
-
SHA512
de3b873d8e55695854d5a652ba77d79d4d371b4736b94c65a6d7695d4b35184c967a392e1e809fef73528d3dcf35fad85d6f3c4043a46977c86183bb35b9ecbb
-
SSDEEP
12288:FU5rCOTeiDq9biZRTWEoXv9cWisANZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDsERRof9esANnCvq5TJLCvY90DA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4176 3345.tmp 3896 33B2.tmp 4880 3410.tmp 4300 34AC.tmp 664 3529.tmp 1664 35B6.tmp 3528 3604.tmp 2188 3652.tmp 2268 36BF.tmp 976 370E.tmp 4028 37AA.tmp 3704 3827.tmp 3024 38B3.tmp 1456 3911.tmp 4296 396F.tmp 3244 39CD.tmp 532 3A3A.tmp 3452 3AA7.tmp 2848 3B05.tmp 3312 3B63.tmp 3760 3BD0.tmp 4504 3C2E.tmp 3716 3CAB.tmp 4432 3D38.tmp 4004 3DA5.tmp 3576 3E03.tmp 2144 3E61.tmp 1612 3EDE.tmp 3128 3F5B.tmp 3964 3FE7.tmp 4772 4045.tmp 3036 40B2.tmp 3032 412F.tmp 1564 418D.tmp 5036 41FA.tmp 2112 4258.tmp 5048 42B6.tmp 4880 4314.tmp 2536 4362.tmp 4556 43B0.tmp 1752 43FE.tmp 4056 444C.tmp 4572 44AA.tmp 4884 44F8.tmp 2000 4556.tmp 4360 45B4.tmp 2796 4611.tmp 4028 465F.tmp 1092 46BD.tmp 3892 471B.tmp 2132 4769.tmp 3012 47C7.tmp 3692 4825.tmp 2728 4873.tmp 4012 48D0.tmp 2072 491F.tmp 4364 496D.tmp 2412 49BB.tmp 1568 4A09.tmp 1416 4A67.tmp 1512 4AB5.tmp 4436 4B13.tmp 4504 4B70.tmp 3216 4BCE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 4176 2776 2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe 82 PID 2776 wrote to memory of 4176 2776 2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe 82 PID 2776 wrote to memory of 4176 2776 2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe 82 PID 4176 wrote to memory of 3896 4176 3345.tmp 83 PID 4176 wrote to memory of 3896 4176 3345.tmp 83 PID 4176 wrote to memory of 3896 4176 3345.tmp 83 PID 3896 wrote to memory of 4880 3896 33B2.tmp 85 PID 3896 wrote to memory of 4880 3896 33B2.tmp 85 PID 3896 wrote to memory of 4880 3896 33B2.tmp 85 PID 4880 wrote to memory of 4300 4880 3410.tmp 87 PID 4880 wrote to memory of 4300 4880 3410.tmp 87 PID 4880 wrote to memory of 4300 4880 3410.tmp 87 PID 4300 wrote to memory of 664 4300 34AC.tmp 88 PID 4300 wrote to memory of 664 4300 34AC.tmp 88 PID 4300 wrote to memory of 664 4300 34AC.tmp 88 PID 664 wrote to memory of 1664 664 3529.tmp 90 PID 664 wrote to memory of 1664 664 3529.tmp 90 PID 664 wrote to memory of 1664 664 3529.tmp 90 PID 1664 wrote to memory of 3528 1664 35B6.tmp 92 PID 1664 wrote to memory of 3528 1664 35B6.tmp 92 PID 1664 wrote to memory of 3528 1664 35B6.tmp 92 PID 3528 wrote to memory of 2188 3528 3604.tmp 93 PID 3528 wrote to memory of 2188 3528 3604.tmp 93 PID 3528 wrote to memory of 2188 3528 3604.tmp 93 PID 2188 wrote to memory of 2268 2188 3652.tmp 94 PID 2188 wrote to memory of 2268 2188 3652.tmp 94 PID 2188 wrote to memory of 2268 2188 3652.tmp 94 PID 2268 wrote to memory of 976 2268 36BF.tmp 95 PID 2268 wrote to memory of 976 2268 36BF.tmp 95 PID 2268 wrote to memory of 976 2268 36BF.tmp 95 PID 976 wrote to memory of 4028 976 370E.tmp 96 PID 976 wrote to memory of 4028 976 370E.tmp 96 PID 976 wrote to memory of 4028 976 370E.tmp 96 PID 4028 wrote to memory of 3704 4028 37AA.tmp 97 PID 4028 wrote to memory of 3704 4028 37AA.tmp 97 PID 4028 wrote to memory of 3704 4028 37AA.tmp 97 PID 3704 wrote to memory of 3024 3704 3827.tmp 98 PID 3704 wrote to memory of 3024 3704 3827.tmp 98 PID 3704 wrote to memory of 3024 3704 3827.tmp 98 PID 3024 wrote to memory of 1456 3024 38B3.tmp 99 PID 3024 wrote to memory of 1456 3024 38B3.tmp 99 PID 3024 wrote to memory of 1456 3024 38B3.tmp 99 PID 1456 wrote to memory of 4296 1456 3911.tmp 100 PID 1456 wrote to memory of 4296 1456 3911.tmp 100 PID 1456 wrote to memory of 4296 1456 3911.tmp 100 PID 4296 wrote to memory of 3244 4296 396F.tmp 101 PID 4296 wrote to memory of 3244 4296 396F.tmp 101 PID 4296 wrote to memory of 3244 4296 396F.tmp 101 PID 3244 wrote to memory of 532 3244 39CD.tmp 102 PID 3244 wrote to memory of 532 3244 39CD.tmp 102 PID 3244 wrote to memory of 532 3244 39CD.tmp 102 PID 532 wrote to memory of 3452 532 3A3A.tmp 103 PID 532 wrote to memory of 3452 532 3A3A.tmp 103 PID 532 wrote to memory of 3452 532 3A3A.tmp 103 PID 3452 wrote to memory of 2848 3452 3AA7.tmp 104 PID 3452 wrote to memory of 2848 3452 3AA7.tmp 104 PID 3452 wrote to memory of 2848 3452 3AA7.tmp 104 PID 2848 wrote to memory of 3312 2848 3B05.tmp 105 PID 2848 wrote to memory of 3312 2848 3B05.tmp 105 PID 2848 wrote to memory of 3312 2848 3B05.tmp 105 PID 3312 wrote to memory of 3760 3312 3B63.tmp 106 PID 3312 wrote to memory of 3760 3312 3B63.tmp 106 PID 3312 wrote to memory of 3760 3312 3B63.tmp 106 PID 3760 wrote to memory of 4504 3760 3BD0.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1426137a6d0361d5e483c7c6cf1702d6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3529.tmp"C:\Users\Admin\AppData\Local\Temp\3529.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\36BF.tmp"C:\Users\Admin\AppData\Local\Temp\36BF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"23⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"24⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"25⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"26⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"27⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"28⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"29⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"30⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"31⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"32⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"33⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"34⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"35⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"36⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"37⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"38⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"39⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"40⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"41⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"42⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"43⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"44⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"45⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"46⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"47⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"48⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"49⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"50⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"51⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"52⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"53⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"54⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"55⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"56⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"57⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"58⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"59⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"60⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"61⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"62⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"63⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"64⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"65⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"66⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"67⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"68⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"69⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"71⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"72⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"73⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"74⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"75⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"76⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"77⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"78⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"79⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"80⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"82⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"83⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"84⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"85⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"86⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"87⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"88⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"89⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"90⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"91⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"92⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"93⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"95⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"96⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"97⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"98⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"99⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"100⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"101⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"102⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"103⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"104⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"105⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"106⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"107⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"108⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"109⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"110⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"111⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"112⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"113⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"114⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"115⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"116⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"117⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"118⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"119⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"120⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"121⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"122⤵PID:3964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-