Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe
-
Size
527KB
-
MD5
6da8ed1af3b6371f522ee941336d0f03
-
SHA1
23cdb2a351f1b2614bf005adde1323e363974f6a
-
SHA256
35f291f33b78965d493007ef2ef9dc679925cc39b93bf2878040a46aae0d7275
-
SHA512
d4abe834986f57a46521402cf59837a5d887060e84a4b465f496c3033e6ed865449c77c0484930c716a53063284427403ae92eccb731e92a3c9b8f75201e7efb
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYMs2FT8VXD7P+kyLj0MX8LA4QV719ZjYgVps0:fU5rCOTeidA++XDL+foA4QkgwDZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3560 84B1.tmp 2692 851E.tmp 348 859B.tmp 440 8628.tmp 2484 8695.tmp 4360 8712.tmp 4724 877F.tmp 468 87ED.tmp 3848 885A.tmp 2008 88A8.tmp 4876 8906.tmp 4476 8964.tmp 3552 89B2.tmp 2452 8A2F.tmp 4680 8A8D.tmp 1996 8ADB.tmp 1704 8B38.tmp 3996 8BA6.tmp 1780 8BF4.tmp 4156 8C61.tmp 1880 8CBF.tmp 3768 8D1D.tmp 208 8D9A.tmp 4572 8DE8.tmp 824 8E36.tmp 4696 8EA3.tmp 1028 8F11.tmp 2196 8F7E.tmp 4836 8FEC.tmp 2244 9069.tmp 4884 90D6.tmp 4656 9143.tmp 4388 91A1.tmp 2268 91EF.tmp 4040 923D.tmp 2228 93E3.tmp 720 9441.tmp 4708 949F.tmp 1708 94ED.tmp 1848 953B.tmp 2760 9589.tmp 4732 95D7.tmp 4560 9625.tmp 4784 9683.tmp 348 96D1.tmp 4508 971F.tmp 2092 976D.tmp 1060 97CB.tmp 3988 9829.tmp 3868 9877.tmp 2184 98D5.tmp 3388 9923.tmp 404 9971.tmp 4764 99CF.tmp 1468 9A2D.tmp 3656 9A8A.tmp 3572 9AE8.tmp 3888 9B46.tmp 4968 9BA4.tmp 4024 9C01.tmp 2276 9C5F.tmp 3148 9CBD.tmp 1348 9D1B.tmp 2880 9D78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 3560 5012 2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe 87 PID 5012 wrote to memory of 3560 5012 2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe 87 PID 5012 wrote to memory of 3560 5012 2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe 87 PID 3560 wrote to memory of 2692 3560 84B1.tmp 89 PID 3560 wrote to memory of 2692 3560 84B1.tmp 89 PID 3560 wrote to memory of 2692 3560 84B1.tmp 89 PID 2692 wrote to memory of 348 2692 851E.tmp 91 PID 2692 wrote to memory of 348 2692 851E.tmp 91 PID 2692 wrote to memory of 348 2692 851E.tmp 91 PID 348 wrote to memory of 440 348 859B.tmp 92 PID 348 wrote to memory of 440 348 859B.tmp 92 PID 348 wrote to memory of 440 348 859B.tmp 92 PID 440 wrote to memory of 2484 440 8628.tmp 93 PID 440 wrote to memory of 2484 440 8628.tmp 93 PID 440 wrote to memory of 2484 440 8628.tmp 93 PID 2484 wrote to memory of 4360 2484 8695.tmp 94 PID 2484 wrote to memory of 4360 2484 8695.tmp 94 PID 2484 wrote to memory of 4360 2484 8695.tmp 94 PID 4360 wrote to memory of 4724 4360 8712.tmp 95 PID 4360 wrote to memory of 4724 4360 8712.tmp 95 PID 4360 wrote to memory of 4724 4360 8712.tmp 95 PID 4724 wrote to memory of 468 4724 877F.tmp 96 PID 4724 wrote to memory of 468 4724 877F.tmp 96 PID 4724 wrote to memory of 468 4724 877F.tmp 96 PID 468 wrote to memory of 3848 468 87ED.tmp 97 PID 468 wrote to memory of 3848 468 87ED.tmp 97 PID 468 wrote to memory of 3848 468 87ED.tmp 97 PID 3848 wrote to memory of 2008 3848 885A.tmp 98 PID 3848 wrote to memory of 2008 3848 885A.tmp 98 PID 3848 wrote to memory of 2008 3848 885A.tmp 98 PID 2008 wrote to memory of 4876 2008 88A8.tmp 99 PID 2008 wrote to memory of 4876 2008 88A8.tmp 99 PID 2008 wrote to memory of 4876 2008 88A8.tmp 99 PID 4876 wrote to memory of 4476 4876 8906.tmp 100 PID 4876 wrote to memory of 4476 4876 8906.tmp 100 PID 4876 wrote to memory of 4476 4876 8906.tmp 100 PID 4476 wrote to memory of 3552 4476 8964.tmp 101 PID 4476 wrote to memory of 3552 4476 8964.tmp 101 PID 4476 wrote to memory of 3552 4476 8964.tmp 101 PID 3552 wrote to memory of 2452 3552 89B2.tmp 102 PID 3552 wrote to memory of 2452 3552 89B2.tmp 102 PID 3552 wrote to memory of 2452 3552 89B2.tmp 102 PID 2452 wrote to memory of 4680 2452 8A2F.tmp 104 PID 2452 wrote to memory of 4680 2452 8A2F.tmp 104 PID 2452 wrote to memory of 4680 2452 8A2F.tmp 104 PID 4680 wrote to memory of 1996 4680 8A8D.tmp 105 PID 4680 wrote to memory of 1996 4680 8A8D.tmp 105 PID 4680 wrote to memory of 1996 4680 8A8D.tmp 105 PID 1996 wrote to memory of 1704 1996 8ADB.tmp 106 PID 1996 wrote to memory of 1704 1996 8ADB.tmp 106 PID 1996 wrote to memory of 1704 1996 8ADB.tmp 106 PID 1704 wrote to memory of 3996 1704 8B38.tmp 107 PID 1704 wrote to memory of 3996 1704 8B38.tmp 107 PID 1704 wrote to memory of 3996 1704 8B38.tmp 107 PID 3996 wrote to memory of 1780 3996 8BA6.tmp 108 PID 3996 wrote to memory of 1780 3996 8BA6.tmp 108 PID 3996 wrote to memory of 1780 3996 8BA6.tmp 108 PID 1780 wrote to memory of 4156 1780 8BF4.tmp 109 PID 1780 wrote to memory of 4156 1780 8BF4.tmp 109 PID 1780 wrote to memory of 4156 1780 8BF4.tmp 109 PID 4156 wrote to memory of 1880 4156 8C61.tmp 110 PID 4156 wrote to memory of 1880 4156 8C61.tmp 110 PID 4156 wrote to memory of 1880 4156 8C61.tmp 110 PID 1880 wrote to memory of 3768 1880 8CBF.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_6da8ed1af3b6371f522ee941336d0f03_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"23⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"24⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"25⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"26⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"27⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"28⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"29⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"30⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"31⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"32⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"33⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"34⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"35⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"36⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"37⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"38⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"39⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"40⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"41⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"42⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"43⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"44⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"45⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"46⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"47⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"48⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"49⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"50⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"51⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"52⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"53⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"54⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"55⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"56⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"57⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"58⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"59⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"60⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"61⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"62⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"63⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"64⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"65⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"66⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"67⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"68⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"69⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"70⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"71⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"72⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"73⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"74⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"75⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"76⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"77⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"78⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"79⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"80⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"81⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"82⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"83⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"84⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"85⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"86⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"87⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"88⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"89⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"90⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"91⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"92⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"93⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"94⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"95⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"96⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"97⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"98⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"99⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"100⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"101⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"102⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"103⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"104⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"105⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"106⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"107⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"108⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"109⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"110⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"111⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"112⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"113⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"114⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"115⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"116⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"117⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"118⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"119⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"120⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"121⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"122⤵PID:3992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-