Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe
-
Size
541KB
-
MD5
742dfc755e84c05dc7ff69893c4acba5
-
SHA1
c781b611f7951da4e96c45e5ea6379c280aa9488
-
SHA256
7fc50cb3a686b13d498af3adb17080630a3565078b9cfabeb36a691d805635fe
-
SHA512
e6a5d97f01db40879031793dfce16a12346416b77ac5a4e7abef45ddb3b3d225be2a0228ecc6e0331f93f2e54a2881032010e3c0af1e19ba3f4bd02597444102
-
SSDEEP
12288:UU5rCOTeifKqiz9f6CSYdz/OdCQMi0hPrZa73ctO:UUQOJfK3ByCDdz/OT4PrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3416 72CE.tmp 2476 733C.tmp 4952 73A9.tmp 4176 7407.tmp 3120 7465.tmp 732 74D2.tmp 3436 753F.tmp 5004 75AD.tmp 4420 761A.tmp 1356 7668.tmp 408 76E5.tmp 3272 7733.tmp 1164 7782.tmp 2536 77D0.tmp 2856 781E.tmp 4612 787C.tmp 2136 78E9.tmp 336 7956.tmp 1824 79B4.tmp 1312 7A02.tmp 1520 7A50.tmp 916 7A9E.tmp 2812 7ADD.tmp 1088 7B3B.tmp 4476 7B89.tmp 4120 7BD7.tmp 2364 7C35.tmp 1248 7C83.tmp 4532 7CD1.tmp 3732 7D3E.tmp 4388 7D8C.tmp 688 7E09.tmp 3040 7E58.tmp 3640 7E96.tmp 732 7EE4.tmp 4908 7F23.tmp 4808 7F71.tmp 3388 7FBF.tmp 2072 800D.tmp 660 805B.tmp 644 80A9.tmp 2760 80F7.tmp 1620 8155.tmp 4464 81B3.tmp 3708 81F1.tmp 2856 8230.tmp 4612 827E.tmp 3304 82CC.tmp 336 831A.tmp 572 8368.tmp 4956 83A7.tmp 208 83E5.tmp 2632 8434.tmp 1952 8482.tmp 800 84D0.tmp 1088 851E.tmp 5012 859B.tmp 3516 8628.tmp 1192 8695.tmp 3456 86F3.tmp 3676 8770.tmp 4248 87ED.tmp 3940 884A.tmp 2636 88E7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 3416 2188 2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe 85 PID 2188 wrote to memory of 3416 2188 2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe 85 PID 2188 wrote to memory of 3416 2188 2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe 85 PID 3416 wrote to memory of 2476 3416 72CE.tmp 86 PID 3416 wrote to memory of 2476 3416 72CE.tmp 86 PID 3416 wrote to memory of 2476 3416 72CE.tmp 86 PID 2476 wrote to memory of 4952 2476 733C.tmp 87 PID 2476 wrote to memory of 4952 2476 733C.tmp 87 PID 2476 wrote to memory of 4952 2476 733C.tmp 87 PID 4952 wrote to memory of 4176 4952 73A9.tmp 88 PID 4952 wrote to memory of 4176 4952 73A9.tmp 88 PID 4952 wrote to memory of 4176 4952 73A9.tmp 88 PID 4176 wrote to memory of 3120 4176 7407.tmp 89 PID 4176 wrote to memory of 3120 4176 7407.tmp 89 PID 4176 wrote to memory of 3120 4176 7407.tmp 89 PID 3120 wrote to memory of 732 3120 7465.tmp 91 PID 3120 wrote to memory of 732 3120 7465.tmp 91 PID 3120 wrote to memory of 732 3120 7465.tmp 91 PID 732 wrote to memory of 3436 732 74D2.tmp 93 PID 732 wrote to memory of 3436 732 74D2.tmp 93 PID 732 wrote to memory of 3436 732 74D2.tmp 93 PID 3436 wrote to memory of 5004 3436 753F.tmp 95 PID 3436 wrote to memory of 5004 3436 753F.tmp 95 PID 3436 wrote to memory of 5004 3436 753F.tmp 95 PID 5004 wrote to memory of 4420 5004 75AD.tmp 96 PID 5004 wrote to memory of 4420 5004 75AD.tmp 96 PID 5004 wrote to memory of 4420 5004 75AD.tmp 96 PID 4420 wrote to memory of 1356 4420 761A.tmp 97 PID 4420 wrote to memory of 1356 4420 761A.tmp 97 PID 4420 wrote to memory of 1356 4420 761A.tmp 97 PID 1356 wrote to memory of 408 1356 7668.tmp 98 PID 1356 wrote to memory of 408 1356 7668.tmp 98 PID 1356 wrote to memory of 408 1356 7668.tmp 98 PID 408 wrote to memory of 3272 408 76E5.tmp 99 PID 408 wrote to memory of 3272 408 76E5.tmp 99 PID 408 wrote to memory of 3272 408 76E5.tmp 99 PID 3272 wrote to memory of 1164 3272 7733.tmp 100 PID 3272 wrote to memory of 1164 3272 7733.tmp 100 PID 3272 wrote to memory of 1164 3272 7733.tmp 100 PID 1164 wrote to memory of 2536 1164 7782.tmp 101 PID 1164 wrote to memory of 2536 1164 7782.tmp 101 PID 1164 wrote to memory of 2536 1164 7782.tmp 101 PID 2536 wrote to memory of 2856 2536 77D0.tmp 102 PID 2536 wrote to memory of 2856 2536 77D0.tmp 102 PID 2536 wrote to memory of 2856 2536 77D0.tmp 102 PID 2856 wrote to memory of 4612 2856 781E.tmp 103 PID 2856 wrote to memory of 4612 2856 781E.tmp 103 PID 2856 wrote to memory of 4612 2856 781E.tmp 103 PID 4612 wrote to memory of 2136 4612 787C.tmp 104 PID 4612 wrote to memory of 2136 4612 787C.tmp 104 PID 4612 wrote to memory of 2136 4612 787C.tmp 104 PID 2136 wrote to memory of 336 2136 78E9.tmp 105 PID 2136 wrote to memory of 336 2136 78E9.tmp 105 PID 2136 wrote to memory of 336 2136 78E9.tmp 105 PID 336 wrote to memory of 1824 336 7956.tmp 106 PID 336 wrote to memory of 1824 336 7956.tmp 106 PID 336 wrote to memory of 1824 336 7956.tmp 106 PID 1824 wrote to memory of 1312 1824 79B4.tmp 107 PID 1824 wrote to memory of 1312 1824 79B4.tmp 107 PID 1824 wrote to memory of 1312 1824 79B4.tmp 107 PID 1312 wrote to memory of 1520 1312 7A02.tmp 110 PID 1312 wrote to memory of 1520 1312 7A02.tmp 110 PID 1312 wrote to memory of 1520 1312 7A02.tmp 110 PID 1520 wrote to memory of 916 1520 7A50.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_742dfc755e84c05dc7ff69893c4acba5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"23⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"24⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"25⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"26⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"27⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"28⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"29⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"30⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"31⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"32⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"33⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"34⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"35⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"36⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"37⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"38⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"39⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"40⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"41⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"42⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"43⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"44⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"45⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"46⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"47⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"48⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"49⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"50⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"51⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"52⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"53⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"54⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"55⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"56⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"57⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"58⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"59⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"60⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"61⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"62⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"63⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"64⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"66⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"67⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"68⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"69⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"70⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"71⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"72⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"73⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"74⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"75⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"76⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"77⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"78⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"79⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"80⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"81⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"82⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"83⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"84⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"85⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"86⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"87⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"89⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"90⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"91⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"92⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"93⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"94⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"95⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"96⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"97⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"98⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"99⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"100⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"101⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"102⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"103⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"104⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"105⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"106⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"107⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"108⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"109⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"110⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"111⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"112⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"113⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"114⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"115⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"116⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"117⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"118⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"119⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"120⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"121⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"122⤵PID:3148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-