Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
-
Size
520KB
-
MD5
709b78e81e1f55ff29907adafe63052a
-
SHA1
96bca3ef556071527529f75c21207fbfadfcae4f
-
SHA256
12e0404251cb3b957842fa00377029f8b1533071a11646bea753277fb5d96347
-
SHA512
665e8345625d4880528c0140b310c89c423af52d55469f184d70472e04583c4572177c47145d9c61d61317647eae612b0e81378eb27ede5bd251a0647a962733
-
SSDEEP
12288:gj8fuxR21t5i8f3UrFvfC/f7JsyyRhl0dUKNZ:gj8fuK1GY3EB275yRhCHN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4584 1A98.tmp 464 1BEF.tmp 5016 1D18.tmp 1896 1E80.tmp 2348 21EB.tmp 4224 2323.tmp 4944 2565.tmp 4076 266F.tmp 872 2788.tmp 2928 2853.tmp 5028 295D.tmp 904 2A28.tmp 892 2AF3.tmp 1556 2B9F.tmp 4332 2C3B.tmp 3112 2D16.tmp 1564 2DF1.tmp 1212 2EEB.tmp 1764 3023.tmp 1048 30EE.tmp 4400 31B9.tmp 3956 3285.tmp 3444 33EC.tmp 4384 34A7.tmp 2276 3563.tmp 3412 362E.tmp 4080 3786.tmp 1176 3822.tmp 1304 38FD.tmp 492 3A16.tmp 2720 3AB2.tmp 4928 3B9D.tmp 4612 3C68.tmp 1768 3D14.tmp 5032 3DB0.tmp 3068 3E4C.tmp 4520 3EC9.tmp 3880 3F75.tmp 2876 4002.tmp 3696 409E.tmp 3224 411B.tmp 2880 41D6.tmp 5036 4273.tmp 3788 431F.tmp 4048 43BB.tmp 4196 4467.tmp 220 4522.tmp 3820 45CE.tmp 2000 466A.tmp 5028 4958.tmp 4320 49F5.tmp 1748 4AC0.tmp 1556 4B4C.tmp 3060 4BF8.tmp 2040 4C94.tmp 3112 4D11.tmp 4412 4D8E.tmp 1776 4E4A.tmp 3296 4ED7.tmp 3464 4F82.tmp 1608 4FFF.tmp 3108 508C.tmp 4664 5109.tmp 4148 5186.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3696 wrote to memory of 4584 3696 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 90 PID 3696 wrote to memory of 4584 3696 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 90 PID 3696 wrote to memory of 4584 3696 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 90 PID 4584 wrote to memory of 464 4584 1A98.tmp 91 PID 4584 wrote to memory of 464 4584 1A98.tmp 91 PID 4584 wrote to memory of 464 4584 1A98.tmp 91 PID 464 wrote to memory of 5016 464 1BEF.tmp 92 PID 464 wrote to memory of 5016 464 1BEF.tmp 92 PID 464 wrote to memory of 5016 464 1BEF.tmp 92 PID 5016 wrote to memory of 1896 5016 1D18.tmp 93 PID 5016 wrote to memory of 1896 5016 1D18.tmp 93 PID 5016 wrote to memory of 1896 5016 1D18.tmp 93 PID 1896 wrote to memory of 2348 1896 1E80.tmp 94 PID 1896 wrote to memory of 2348 1896 1E80.tmp 94 PID 1896 wrote to memory of 2348 1896 1E80.tmp 94 PID 2348 wrote to memory of 4224 2348 21EB.tmp 95 PID 2348 wrote to memory of 4224 2348 21EB.tmp 95 PID 2348 wrote to memory of 4224 2348 21EB.tmp 95 PID 4224 wrote to memory of 4944 4224 2323.tmp 96 PID 4224 wrote to memory of 4944 4224 2323.tmp 96 PID 4224 wrote to memory of 4944 4224 2323.tmp 96 PID 4944 wrote to memory of 4076 4944 2565.tmp 97 PID 4944 wrote to memory of 4076 4944 2565.tmp 97 PID 4944 wrote to memory of 4076 4944 2565.tmp 97 PID 4076 wrote to memory of 872 4076 266F.tmp 98 PID 4076 wrote to memory of 872 4076 266F.tmp 98 PID 4076 wrote to memory of 872 4076 266F.tmp 98 PID 872 wrote to memory of 2928 872 2788.tmp 99 PID 872 wrote to memory of 2928 872 2788.tmp 99 PID 872 wrote to memory of 2928 872 2788.tmp 99 PID 2928 wrote to memory of 5028 2928 2853.tmp 100 PID 2928 wrote to memory of 5028 2928 2853.tmp 100 PID 2928 wrote to memory of 5028 2928 2853.tmp 100 PID 5028 wrote to memory of 904 5028 295D.tmp 101 PID 5028 wrote to memory of 904 5028 295D.tmp 101 PID 5028 wrote to memory of 904 5028 295D.tmp 101 PID 904 wrote to memory of 892 904 2A28.tmp 102 PID 904 wrote to memory of 892 904 2A28.tmp 102 PID 904 wrote to memory of 892 904 2A28.tmp 102 PID 892 wrote to memory of 1556 892 2AF3.tmp 103 PID 892 wrote to memory of 1556 892 2AF3.tmp 103 PID 892 wrote to memory of 1556 892 2AF3.tmp 103 PID 1556 wrote to memory of 4332 1556 2B9F.tmp 104 PID 1556 wrote to memory of 4332 1556 2B9F.tmp 104 PID 1556 wrote to memory of 4332 1556 2B9F.tmp 104 PID 4332 wrote to memory of 3112 4332 2C3B.tmp 105 PID 4332 wrote to memory of 3112 4332 2C3B.tmp 105 PID 4332 wrote to memory of 3112 4332 2C3B.tmp 105 PID 3112 wrote to memory of 1564 3112 2D16.tmp 106 PID 3112 wrote to memory of 1564 3112 2D16.tmp 106 PID 3112 wrote to memory of 1564 3112 2D16.tmp 106 PID 1564 wrote to memory of 1212 1564 2DF1.tmp 107 PID 1564 wrote to memory of 1212 1564 2DF1.tmp 107 PID 1564 wrote to memory of 1212 1564 2DF1.tmp 107 PID 1212 wrote to memory of 1764 1212 2EEB.tmp 108 PID 1212 wrote to memory of 1764 1212 2EEB.tmp 108 PID 1212 wrote to memory of 1764 1212 2EEB.tmp 108 PID 1764 wrote to memory of 1048 1764 3023.tmp 109 PID 1764 wrote to memory of 1048 1764 3023.tmp 109 PID 1764 wrote to memory of 1048 1764 3023.tmp 109 PID 1048 wrote to memory of 4400 1048 30EE.tmp 110 PID 1048 wrote to memory of 4400 1048 30EE.tmp 110 PID 1048 wrote to memory of 4400 1048 30EE.tmp 110 PID 4400 wrote to memory of 3956 4400 31B9.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"23⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"24⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"25⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"26⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"27⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"28⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"29⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"30⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"31⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"32⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"33⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"34⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"35⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"36⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"37⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"38⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"39⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"40⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"41⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"42⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"43⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"44⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"45⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"46⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"47⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"48⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"49⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"50⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"51⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"52⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"53⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"54⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"55⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"56⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"57⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"58⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"59⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"60⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"61⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"62⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"63⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"64⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"65⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"66⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"67⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"68⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\53B9.tmp"C:\Users\Admin\AppData\Local\Temp\53B9.tmp"69⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"70⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"71⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"72⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"73⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"74⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"75⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"76⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"77⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"78⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"79⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"80⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"81⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"82⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"83⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"84⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"85⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\601C.tmp"C:\Users\Admin\AppData\Local\Temp\601C.tmp"86⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"87⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"88⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"89⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\630A.tmp"C:\Users\Admin\AppData\Local\Temp\630A.tmp"90⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"91⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"92⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"93⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"94⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"95⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"97⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"98⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"99⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"100⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"101⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"102⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"103⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6E17.tmp"C:\Users\Admin\AppData\Local\Temp\6E17.tmp"104⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"105⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"106⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"107⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"108⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"109⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"110⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"111⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"112⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"113⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"114⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"115⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\77CB.tmp"C:\Users\Admin\AppData\Local\Temp\77CB.tmp"116⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"117⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"119⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"120⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"121⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"122⤵PID:3308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-