Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 16:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe
-
Size
487KB
-
MD5
d9fe925ddf589f16a739f4e73151b619
-
SHA1
fb872872e7de45b9292f67c85d942cd5b0a1589d
-
SHA256
2017314f90c0907fed1b8bf1eda7909a8352cf4f030fcc63cc68071be0259727
-
SHA512
4832aa4e3ef51d26ce13369b297a5e78a240efbf60796c523e4654f852939b76d73c2645bcbe2c7a1607e8142fda615cf8e40023b23f745921395feb8768a346
-
SSDEEP
12288:HU5rCOTeiJ8SXp/AavE0A0g/14H7ugm0zCOGGJ6NZ:HUQOJJF/AwEsI4ygHbJ4N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1144 4D35.tmp 2860 4DA3.tmp 1732 4E20.tmp 1216 4E9D.tmp 3560 4EEB.tmp 2616 4F68.tmp 4068 4FF5.tmp 1448 5043.tmp 1524 50A0.tmp 2848 512D.tmp 2352 518B.tmp 3608 51E9.tmp 3456 5266.tmp 2508 52D3.tmp 4264 536F.tmp 1124 53CD.tmp 1728 543A.tmp 1016 5498.tmp 3776 54F6.tmp 3148 5554.tmp 3552 55E0.tmp 1412 564E.tmp 2824 569C.tmp 3996 57D4.tmp 5044 5851.tmp 3988 58BF.tmp 1040 592C.tmp 3344 59A9.tmp 2952 5A07.tmp 2460 5A84.tmp 4560 5AE1.tmp 3948 5B3F.tmp 920 5B9D.tmp 2572 5BFB.tmp 4176 5C49.tmp 1216 5CA7.tmp 1780 5CF5.tmp 4084 5D62.tmp 2472 5DC0.tmp 3844 5E0E.tmp 3260 5E7B.tmp 4296 5ED9.tmp 2176 5F37.tmp 1328 5F95.tmp 3836 5FF2.tmp 4952 6050.tmp 3680 60AE.tmp 4836 60FC.tmp 4660 615A.tmp 3872 61B7.tmp 4536 6206.tmp 3192 6263.tmp 2068 62C1.tmp 3096 631F.tmp 1124 638C.tmp 3316 63EA.tmp 1828 6448.tmp 3944 64A5.tmp 1980 64F4.tmp 4752 6551.tmp 672 65AF.tmp 3048 660D.tmp 740 666B.tmp 3480 66B9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1144 1488 2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe 83 PID 1488 wrote to memory of 1144 1488 2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe 83 PID 1488 wrote to memory of 1144 1488 2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe 83 PID 1144 wrote to memory of 2860 1144 4D35.tmp 84 PID 1144 wrote to memory of 2860 1144 4D35.tmp 84 PID 1144 wrote to memory of 2860 1144 4D35.tmp 84 PID 2860 wrote to memory of 1732 2860 4DA3.tmp 85 PID 2860 wrote to memory of 1732 2860 4DA3.tmp 85 PID 2860 wrote to memory of 1732 2860 4DA3.tmp 85 PID 1732 wrote to memory of 1216 1732 4E20.tmp 86 PID 1732 wrote to memory of 1216 1732 4E20.tmp 86 PID 1732 wrote to memory of 1216 1732 4E20.tmp 86 PID 1216 wrote to memory of 3560 1216 4E9D.tmp 87 PID 1216 wrote to memory of 3560 1216 4E9D.tmp 87 PID 1216 wrote to memory of 3560 1216 4E9D.tmp 87 PID 3560 wrote to memory of 2616 3560 4EEB.tmp 88 PID 3560 wrote to memory of 2616 3560 4EEB.tmp 88 PID 3560 wrote to memory of 2616 3560 4EEB.tmp 88 PID 2616 wrote to memory of 4068 2616 4F68.tmp 90 PID 2616 wrote to memory of 4068 2616 4F68.tmp 90 PID 2616 wrote to memory of 4068 2616 4F68.tmp 90 PID 4068 wrote to memory of 1448 4068 4FF5.tmp 92 PID 4068 wrote to memory of 1448 4068 4FF5.tmp 92 PID 4068 wrote to memory of 1448 4068 4FF5.tmp 92 PID 1448 wrote to memory of 1524 1448 5043.tmp 94 PID 1448 wrote to memory of 1524 1448 5043.tmp 94 PID 1448 wrote to memory of 1524 1448 5043.tmp 94 PID 1524 wrote to memory of 2848 1524 50A0.tmp 95 PID 1524 wrote to memory of 2848 1524 50A0.tmp 95 PID 1524 wrote to memory of 2848 1524 50A0.tmp 95 PID 2848 wrote to memory of 2352 2848 512D.tmp 96 PID 2848 wrote to memory of 2352 2848 512D.tmp 96 PID 2848 wrote to memory of 2352 2848 512D.tmp 96 PID 2352 wrote to memory of 3608 2352 518B.tmp 97 PID 2352 wrote to memory of 3608 2352 518B.tmp 97 PID 2352 wrote to memory of 3608 2352 518B.tmp 97 PID 3608 wrote to memory of 3456 3608 51E9.tmp 98 PID 3608 wrote to memory of 3456 3608 51E9.tmp 98 PID 3608 wrote to memory of 3456 3608 51E9.tmp 98 PID 3456 wrote to memory of 2508 3456 5266.tmp 100 PID 3456 wrote to memory of 2508 3456 5266.tmp 100 PID 3456 wrote to memory of 2508 3456 5266.tmp 100 PID 2508 wrote to memory of 4264 2508 52D3.tmp 101 PID 2508 wrote to memory of 4264 2508 52D3.tmp 101 PID 2508 wrote to memory of 4264 2508 52D3.tmp 101 PID 4264 wrote to memory of 1124 4264 536F.tmp 102 PID 4264 wrote to memory of 1124 4264 536F.tmp 102 PID 4264 wrote to memory of 1124 4264 536F.tmp 102 PID 1124 wrote to memory of 1728 1124 53CD.tmp 103 PID 1124 wrote to memory of 1728 1124 53CD.tmp 103 PID 1124 wrote to memory of 1728 1124 53CD.tmp 103 PID 1728 wrote to memory of 1016 1728 543A.tmp 104 PID 1728 wrote to memory of 1016 1728 543A.tmp 104 PID 1728 wrote to memory of 1016 1728 543A.tmp 104 PID 1016 wrote to memory of 3776 1016 5498.tmp 105 PID 1016 wrote to memory of 3776 1016 5498.tmp 105 PID 1016 wrote to memory of 3776 1016 5498.tmp 105 PID 3776 wrote to memory of 3148 3776 54F6.tmp 106 PID 3776 wrote to memory of 3148 3776 54F6.tmp 106 PID 3776 wrote to memory of 3148 3776 54F6.tmp 106 PID 3148 wrote to memory of 3552 3148 5554.tmp 107 PID 3148 wrote to memory of 3552 3148 5554.tmp 107 PID 3148 wrote to memory of 3552 3148 5554.tmp 107 PID 3552 wrote to memory of 1412 3552 55E0.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_d9fe925ddf589f16a739f4e73151b619_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"23⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"24⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"25⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"26⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"27⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"28⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"29⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"30⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"31⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"32⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"33⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"34⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"35⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"36⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"37⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"38⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"39⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"40⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"41⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"42⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"43⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"44⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"45⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"46⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"47⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"48⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"49⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"50⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"51⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"52⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"53⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"54⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"55⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"56⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"57⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"58⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"59⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"60⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"61⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"62⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"63⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"64⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"65⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"66⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"67⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"68⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"69⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"70⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"72⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"73⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"74⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"75⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"76⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"77⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"78⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"79⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"80⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"81⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"82⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"83⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"84⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"85⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"86⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"87⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"89⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"90⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"91⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"92⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"93⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"94⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"95⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"96⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"97⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"99⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"100⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"101⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"102⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"103⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"104⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"105⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"106⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"107⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"108⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"109⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"110⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"111⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"112⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"113⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"114⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"115⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"116⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"117⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"118⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"119⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"120⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"121⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"122⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-