Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe
-
Size
520KB
-
MD5
edcf5770fc8b31302b00a8309b12fdeb
-
SHA1
44fe50d91a111644542aa4a190a3d27ab0f190c8
-
SHA256
b1efe04c1215aed29c65dd89eb01b28b8e506d8b68a6c20033134e05740c859f
-
SHA512
5d8e9a7eb0c1e0f2d7dcef8be7c6edfb8d9300817a143443d3f3377c1be77b69ea2513bbd9cdef10784742bd66647771135d64dcede6de9a0076d93ee45b4adb
-
SSDEEP
12288:gj8fuxR21t5i8fe6spvqUvz8B6HTZ0dfhNZ:gj8fuK1GYVsBquk6HTZ0dfhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4624 6F06.tmp 892 6F73.tmp 2616 6FF0.tmp 3600 707D.tmp 1504 7119.tmp 4948 7186.tmp 1324 71F4.tmp 3768 7271.tmp 1060 72DE.tmp 3688 734B.tmp 960 73B9.tmp 4532 7426.tmp 5040 74A3.tmp 540 7501.tmp 380 755F.tmp 4528 75DC.tmp 2428 7639.tmp 2176 7697.tmp 3652 7705.tmp 3936 7782.tmp 3868 77DF.tmp 404 783D.tmp 4720 789B.tmp 3460 78E9.tmp 4520 7966.tmp 3844 79C4.tmp 640 7A41.tmp 5004 7ABE.tmp 2224 7B3B.tmp 3668 7BB8.tmp 4920 7C15.tmp 4996 7C92.tmp 316 7CF0.tmp 1576 7D4E.tmp 2208 7DAC.tmp 3400 7E09.tmp 4828 7E58.tmp 4048 7EA6.tmp 3708 7EF4.tmp 3312 7F42.tmp 3148 7F90.tmp 3176 7FDE.tmp 4972 803C.tmp 2204 808A.tmp 2252 80D8.tmp 3260 8126.tmp 4024 8184.tmp 2360 81E2.tmp 3976 8230.tmp 1144 827E.tmp 2108 82DC.tmp 4452 832A.tmp 4380 8378.tmp 4256 83D6.tmp 2512 8424.tmp 2632 8472.tmp 652 84C0.tmp 3160 850E.tmp 4580 855C.tmp 4008 85AB.tmp 2616 8608.tmp 2064 8656.tmp 3296 86B4.tmp 2092 8702.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 4624 548 2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe 83 PID 548 wrote to memory of 4624 548 2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe 83 PID 548 wrote to memory of 4624 548 2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe 83 PID 4624 wrote to memory of 892 4624 6F06.tmp 84 PID 4624 wrote to memory of 892 4624 6F06.tmp 84 PID 4624 wrote to memory of 892 4624 6F06.tmp 84 PID 892 wrote to memory of 2616 892 6F73.tmp 85 PID 892 wrote to memory of 2616 892 6F73.tmp 85 PID 892 wrote to memory of 2616 892 6F73.tmp 85 PID 2616 wrote to memory of 3600 2616 6FF0.tmp 86 PID 2616 wrote to memory of 3600 2616 6FF0.tmp 86 PID 2616 wrote to memory of 3600 2616 6FF0.tmp 86 PID 3600 wrote to memory of 1504 3600 707D.tmp 87 PID 3600 wrote to memory of 1504 3600 707D.tmp 87 PID 3600 wrote to memory of 1504 3600 707D.tmp 87 PID 1504 wrote to memory of 4948 1504 7119.tmp 88 PID 1504 wrote to memory of 4948 1504 7119.tmp 88 PID 1504 wrote to memory of 4948 1504 7119.tmp 88 PID 4948 wrote to memory of 1324 4948 7186.tmp 89 PID 4948 wrote to memory of 1324 4948 7186.tmp 89 PID 4948 wrote to memory of 1324 4948 7186.tmp 89 PID 1324 wrote to memory of 3768 1324 71F4.tmp 90 PID 1324 wrote to memory of 3768 1324 71F4.tmp 90 PID 1324 wrote to memory of 3768 1324 71F4.tmp 90 PID 3768 wrote to memory of 1060 3768 7271.tmp 91 PID 3768 wrote to memory of 1060 3768 7271.tmp 91 PID 3768 wrote to memory of 1060 3768 7271.tmp 91 PID 1060 wrote to memory of 3688 1060 72DE.tmp 92 PID 1060 wrote to memory of 3688 1060 72DE.tmp 92 PID 1060 wrote to memory of 3688 1060 72DE.tmp 92 PID 3688 wrote to memory of 960 3688 734B.tmp 93 PID 3688 wrote to memory of 960 3688 734B.tmp 93 PID 3688 wrote to memory of 960 3688 734B.tmp 93 PID 960 wrote to memory of 4532 960 73B9.tmp 94 PID 960 wrote to memory of 4532 960 73B9.tmp 94 PID 960 wrote to memory of 4532 960 73B9.tmp 94 PID 4532 wrote to memory of 5040 4532 7426.tmp 95 PID 4532 wrote to memory of 5040 4532 7426.tmp 95 PID 4532 wrote to memory of 5040 4532 7426.tmp 95 PID 5040 wrote to memory of 540 5040 74A3.tmp 96 PID 5040 wrote to memory of 540 5040 74A3.tmp 96 PID 5040 wrote to memory of 540 5040 74A3.tmp 96 PID 540 wrote to memory of 380 540 7501.tmp 97 PID 540 wrote to memory of 380 540 7501.tmp 97 PID 540 wrote to memory of 380 540 7501.tmp 97 PID 380 wrote to memory of 4528 380 755F.tmp 98 PID 380 wrote to memory of 4528 380 755F.tmp 98 PID 380 wrote to memory of 4528 380 755F.tmp 98 PID 4528 wrote to memory of 2428 4528 75DC.tmp 99 PID 4528 wrote to memory of 2428 4528 75DC.tmp 99 PID 4528 wrote to memory of 2428 4528 75DC.tmp 99 PID 2428 wrote to memory of 2176 2428 7639.tmp 100 PID 2428 wrote to memory of 2176 2428 7639.tmp 100 PID 2428 wrote to memory of 2176 2428 7639.tmp 100 PID 2176 wrote to memory of 3652 2176 7697.tmp 101 PID 2176 wrote to memory of 3652 2176 7697.tmp 101 PID 2176 wrote to memory of 3652 2176 7697.tmp 101 PID 3652 wrote to memory of 3936 3652 7705.tmp 102 PID 3652 wrote to memory of 3936 3652 7705.tmp 102 PID 3652 wrote to memory of 3936 3652 7705.tmp 102 PID 3936 wrote to memory of 3868 3936 7782.tmp 103 PID 3936 wrote to memory of 3868 3936 7782.tmp 103 PID 3936 wrote to memory of 3868 3936 7782.tmp 103 PID 3868 wrote to memory of 404 3868 77DF.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_edcf5770fc8b31302b00a8309b12fdeb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"23⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"24⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"25⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"26⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"27⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"28⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"29⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"30⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"31⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"32⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"33⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"34⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"35⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"36⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"37⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"38⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"39⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"40⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"41⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"42⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"43⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"44⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"45⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"46⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"47⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"48⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"49⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"50⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"51⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"52⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"53⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"54⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"55⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"56⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"57⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"58⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"59⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"60⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"61⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"62⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"63⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"64⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"65⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"66⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"67⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"68⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"69⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"70⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"71⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"72⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"73⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"74⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"75⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"76⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"77⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"78⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"79⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"80⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"81⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"82⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"83⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"84⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"85⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"86⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"87⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"88⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"89⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"90⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"91⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"92⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"93⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"94⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"95⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"96⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"97⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"98⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"99⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"100⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"101⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"102⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"103⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"104⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"105⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"106⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"107⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"108⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"109⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"110⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"111⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"112⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"113⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"114⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"115⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"116⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"117⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"118⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"119⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"120⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"121⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-