Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe
-
Size
712KB
-
MD5
641ee83cbf7191aa2d3070cb9468ec39
-
SHA1
fcfa1cd40ed04ff8c5a08ea69628985d7634c811
-
SHA256
7b94a04981bcf8f30d63b577fa886485d7cf531f2f1f647044fc5218cac589c2
-
SHA512
1895ca8f0ca98170714ef7670e91b7811bcf7b3ccf2fd69edb14f14705d5aef4938ce86267e0ef448d8f0e74ca0e4ab50e4d67343a7ef85f651918ee702d831d
-
SSDEEP
12288:FU5rCOTeiDvtZyzKn7BaZ2EAfj0sc3N3+PdNZdCvq5TJLCvY90D8/LVBlVk736YI:FUQOJDvV7BaZ2EArv8NSdNnCvq5TJLC0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3276 F685.tmp 396 F702.tmp 3876 F77F.tmp 2580 F80C.tmp 2996 F898.tmp 2588 F906.tmp 704 F992.tmp 8 FA1F.tmp 1964 FA9C.tmp 992 FAFA.tmp 4340 FB77.tmp 4968 FBE4.tmp 4632 FC71.tmp 4840 FCDE.tmp 4452 FD3C.tmp 1088 FDD8.tmp 4400 FE74.tmp 1832 FEE2.tmp 3376 FF40.tmp 460 FFAD.tmp 4124 3A.tmp 216 88.tmp 3988 E5.tmp 4352 143.tmp 4732 1B1.tmp 4872 23D.tmp 4396 29B.tmp 2568 328.tmp 4948 385.tmp 2176 402.tmp 2772 460.tmp 3568 4ED.tmp 3248 53B.tmp 1956 599.tmp 532 5E7.tmp 4632 644.tmp 4840 693.tmp 2596 6F0.tmp 3708 74E.tmp 548 79C.tmp 2988 7EA.tmp 3376 848.tmp 4288 896.tmp 5068 8F4.tmp 2936 942.tmp 2296 9A0.tmp 224 9FE.tmp 856 A4C.tmp 4896 A9A.tmp 4872 AF8.tmp 2272 B55.tmp 4320 BB3.tmp 1712 C01.tmp 60 C5F.tmp 2176 CBD.tmp 4812 D1A.tmp 4980 D69.tmp 2636 DC6.tmp 2204 E14.tmp 3372 E63.tmp 4676 EB1.tmp 2020 F0E.tmp 3712 F6C.tmp 2848 FCA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3276 4864 2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe 92 PID 4864 wrote to memory of 3276 4864 2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe 92 PID 4864 wrote to memory of 3276 4864 2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe 92 PID 3276 wrote to memory of 396 3276 F685.tmp 93 PID 3276 wrote to memory of 396 3276 F685.tmp 93 PID 3276 wrote to memory of 396 3276 F685.tmp 93 PID 396 wrote to memory of 3876 396 F702.tmp 94 PID 396 wrote to memory of 3876 396 F702.tmp 94 PID 396 wrote to memory of 3876 396 F702.tmp 94 PID 3876 wrote to memory of 2580 3876 F77F.tmp 95 PID 3876 wrote to memory of 2580 3876 F77F.tmp 95 PID 3876 wrote to memory of 2580 3876 F77F.tmp 95 PID 2580 wrote to memory of 2996 2580 F80C.tmp 96 PID 2580 wrote to memory of 2996 2580 F80C.tmp 96 PID 2580 wrote to memory of 2996 2580 F80C.tmp 96 PID 2996 wrote to memory of 2588 2996 F898.tmp 98 PID 2996 wrote to memory of 2588 2996 F898.tmp 98 PID 2996 wrote to memory of 2588 2996 F898.tmp 98 PID 2588 wrote to memory of 704 2588 F906.tmp 99 PID 2588 wrote to memory of 704 2588 F906.tmp 99 PID 2588 wrote to memory of 704 2588 F906.tmp 99 PID 704 wrote to memory of 8 704 F992.tmp 100 PID 704 wrote to memory of 8 704 F992.tmp 100 PID 704 wrote to memory of 8 704 F992.tmp 100 PID 8 wrote to memory of 1964 8 FA1F.tmp 101 PID 8 wrote to memory of 1964 8 FA1F.tmp 101 PID 8 wrote to memory of 1964 8 FA1F.tmp 101 PID 1964 wrote to memory of 992 1964 FA9C.tmp 102 PID 1964 wrote to memory of 992 1964 FA9C.tmp 102 PID 1964 wrote to memory of 992 1964 FA9C.tmp 102 PID 992 wrote to memory of 4340 992 FAFA.tmp 103 PID 992 wrote to memory of 4340 992 FAFA.tmp 103 PID 992 wrote to memory of 4340 992 FAFA.tmp 103 PID 4340 wrote to memory of 4968 4340 FB77.tmp 104 PID 4340 wrote to memory of 4968 4340 FB77.tmp 104 PID 4340 wrote to memory of 4968 4340 FB77.tmp 104 PID 4968 wrote to memory of 4632 4968 FBE4.tmp 105 PID 4968 wrote to memory of 4632 4968 FBE4.tmp 105 PID 4968 wrote to memory of 4632 4968 FBE4.tmp 105 PID 4632 wrote to memory of 4840 4632 FC71.tmp 106 PID 4632 wrote to memory of 4840 4632 FC71.tmp 106 PID 4632 wrote to memory of 4840 4632 FC71.tmp 106 PID 4840 wrote to memory of 4452 4840 FCDE.tmp 107 PID 4840 wrote to memory of 4452 4840 FCDE.tmp 107 PID 4840 wrote to memory of 4452 4840 FCDE.tmp 107 PID 4452 wrote to memory of 1088 4452 FD3C.tmp 108 PID 4452 wrote to memory of 1088 4452 FD3C.tmp 108 PID 4452 wrote to memory of 1088 4452 FD3C.tmp 108 PID 1088 wrote to memory of 4400 1088 FDD8.tmp 109 PID 1088 wrote to memory of 4400 1088 FDD8.tmp 109 PID 1088 wrote to memory of 4400 1088 FDD8.tmp 109 PID 4400 wrote to memory of 1832 4400 FE74.tmp 110 PID 4400 wrote to memory of 1832 4400 FE74.tmp 110 PID 4400 wrote to memory of 1832 4400 FE74.tmp 110 PID 1832 wrote to memory of 3376 1832 FEE2.tmp 111 PID 1832 wrote to memory of 3376 1832 FEE2.tmp 111 PID 1832 wrote to memory of 3376 1832 FEE2.tmp 111 PID 3376 wrote to memory of 460 3376 FF40.tmp 112 PID 3376 wrote to memory of 460 3376 FF40.tmp 112 PID 3376 wrote to memory of 460 3376 FF40.tmp 112 PID 460 wrote to memory of 4124 460 FFAD.tmp 115 PID 460 wrote to memory of 4124 460 FFAD.tmp 115 PID 460 wrote to memory of 4124 460 FFAD.tmp 115 PID 4124 wrote to memory of 216 4124 3A.tmp 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_641ee83cbf7191aa2d3070cb9468ec39_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"23⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"24⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"25⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"26⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"27⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"28⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"29⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"30⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"31⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"32⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"33⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"34⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"35⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"36⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"37⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"38⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"39⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"40⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"41⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"42⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"43⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"44⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"45⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"46⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"47⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"48⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"49⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"50⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"51⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"52⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"53⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"54⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"55⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"56⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"57⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"58⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"59⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"60⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"61⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"62⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"63⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"64⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"65⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"66⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"67⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"68⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"69⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"70⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"71⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"72⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"73⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"74⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"75⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"76⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"77⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"78⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"79⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"80⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"81⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"82⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"83⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"84⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"85⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"86⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"87⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"88⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"89⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"90⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"91⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"92⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"93⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"94⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"95⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"96⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"97⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"98⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"99⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"100⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"101⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"102⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"103⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"104⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"105⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"106⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"108⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"109⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"110⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"111⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"112⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"113⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"114⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"115⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"116⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"117⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"118⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"119⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"120⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"121⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-