Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
-
Size
520KB
-
MD5
b98a5102fef224967870b1f589fdd5ff
-
SHA1
b2d6e03ee3711211c4235d7dd83f8da807b5eec6
-
SHA256
706572b1b0eaf480478c7f020b3c222123ec4bb3fc4661dedd005f41fff68c13
-
SHA512
3d174f85fe1258f7c2136aef2f58052f4f5ccdfe3cb5febb9b8732bf686bbdfaf101c2bcf8a1307608e1385f82f7dd0d7db88c5e30241d0f960586e487238bba
-
SSDEEP
12288:gj8fuxR21t5i8fjUnftgH1S5c8X+j+mo55T3gpsoNpNZ:gj8fuK1GYjU1KSC8Xoo5lc7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4456 39FC.tmp 4252 3A79.tmp 2208 3B05.tmp 5112 3B92.tmp 2636 3C0F.tmp 2540 3C8C.tmp 4424 3CDA.tmp 2120 3D47.tmp 1716 3DC4.tmp 1460 3E22.tmp 2472 3E70.tmp 904 3EDE.tmp 3116 3F2C.tmp 116 3F7A.tmp 4012 3FD8.tmp 4612 4026.tmp 548 4093.tmp 636 40F1.tmp 4624 414F.tmp 864 41BC.tmp 4404 420A.tmp 2352 4268.tmp 2844 42B6.tmp 1324 4304.tmp 2612 4362.tmp 1696 43CF.tmp 3152 442D.tmp 3804 447B.tmp 2484 44C9.tmp 4976 4517.tmp 4784 4575.tmp 2312 45C3.tmp 4036 4631.tmp 4956 467F.tmp 4588 46CD.tmp 3480 471B.tmp 4792 4769.tmp 4500 47B7.tmp 2916 4805.tmp 4120 4844.tmp 64 4882.tmp 3056 48D0.tmp 3520 491F.tmp 1692 496D.tmp 4700 49BB.tmp 3384 4A09.tmp 2816 4A57.tmp 2148 4AA5.tmp 4924 4AE4.tmp 772 4B22.tmp 3088 4B70.tmp 3084 4BBE.tmp 3272 4C0D.tmp 3068 4C5B.tmp 676 4CA9.tmp 3772 4CF7.tmp 3252 4D45.tmp 4688 4D93.tmp 3220 4DD2.tmp 5100 4E20.tmp 4856 4E6E.tmp 4620 4EBC.tmp 2024 4F0A.tmp 2520 4F58.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4576 wrote to memory of 4456 4576 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 80 PID 4576 wrote to memory of 4456 4576 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 80 PID 4576 wrote to memory of 4456 4576 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 80 PID 4456 wrote to memory of 4252 4456 39FC.tmp 81 PID 4456 wrote to memory of 4252 4456 39FC.tmp 81 PID 4456 wrote to memory of 4252 4456 39FC.tmp 81 PID 4252 wrote to memory of 2208 4252 3A79.tmp 82 PID 4252 wrote to memory of 2208 4252 3A79.tmp 82 PID 4252 wrote to memory of 2208 4252 3A79.tmp 82 PID 2208 wrote to memory of 5112 2208 3B05.tmp 83 PID 2208 wrote to memory of 5112 2208 3B05.tmp 83 PID 2208 wrote to memory of 5112 2208 3B05.tmp 83 PID 5112 wrote to memory of 2636 5112 3B92.tmp 84 PID 5112 wrote to memory of 2636 5112 3B92.tmp 84 PID 5112 wrote to memory of 2636 5112 3B92.tmp 84 PID 2636 wrote to memory of 2540 2636 3C0F.tmp 85 PID 2636 wrote to memory of 2540 2636 3C0F.tmp 85 PID 2636 wrote to memory of 2540 2636 3C0F.tmp 85 PID 2540 wrote to memory of 4424 2540 3C8C.tmp 86 PID 2540 wrote to memory of 4424 2540 3C8C.tmp 86 PID 2540 wrote to memory of 4424 2540 3C8C.tmp 86 PID 4424 wrote to memory of 2120 4424 3CDA.tmp 87 PID 4424 wrote to memory of 2120 4424 3CDA.tmp 87 PID 4424 wrote to memory of 2120 4424 3CDA.tmp 87 PID 2120 wrote to memory of 1716 2120 3D47.tmp 88 PID 2120 wrote to memory of 1716 2120 3D47.tmp 88 PID 2120 wrote to memory of 1716 2120 3D47.tmp 88 PID 1716 wrote to memory of 1460 1716 3DC4.tmp 89 PID 1716 wrote to memory of 1460 1716 3DC4.tmp 89 PID 1716 wrote to memory of 1460 1716 3DC4.tmp 89 PID 1460 wrote to memory of 2472 1460 3E22.tmp 164 PID 1460 wrote to memory of 2472 1460 3E22.tmp 164 PID 1460 wrote to memory of 2472 1460 3E22.tmp 164 PID 2472 wrote to memory of 904 2472 3E70.tmp 91 PID 2472 wrote to memory of 904 2472 3E70.tmp 91 PID 2472 wrote to memory of 904 2472 3E70.tmp 91 PID 904 wrote to memory of 3116 904 3EDE.tmp 92 PID 904 wrote to memory of 3116 904 3EDE.tmp 92 PID 904 wrote to memory of 3116 904 3EDE.tmp 92 PID 3116 wrote to memory of 116 3116 3F2C.tmp 93 PID 3116 wrote to memory of 116 3116 3F2C.tmp 93 PID 3116 wrote to memory of 116 3116 3F2C.tmp 93 PID 116 wrote to memory of 4012 116 3F7A.tmp 169 PID 116 wrote to memory of 4012 116 3F7A.tmp 169 PID 116 wrote to memory of 4012 116 3F7A.tmp 169 PID 4012 wrote to memory of 4612 4012 3FD8.tmp 95 PID 4012 wrote to memory of 4612 4012 3FD8.tmp 95 PID 4012 wrote to memory of 4612 4012 3FD8.tmp 95 PID 4612 wrote to memory of 548 4612 4026.tmp 96 PID 4612 wrote to memory of 548 4612 4026.tmp 96 PID 4612 wrote to memory of 548 4612 4026.tmp 96 PID 548 wrote to memory of 636 548 4093.tmp 97 PID 548 wrote to memory of 636 548 4093.tmp 97 PID 548 wrote to memory of 636 548 4093.tmp 97 PID 636 wrote to memory of 4624 636 40F1.tmp 98 PID 636 wrote to memory of 4624 636 40F1.tmp 98 PID 636 wrote to memory of 4624 636 40F1.tmp 98 PID 4624 wrote to memory of 864 4624 414F.tmp 99 PID 4624 wrote to memory of 864 4624 414F.tmp 99 PID 4624 wrote to memory of 864 4624 414F.tmp 99 PID 864 wrote to memory of 4404 864 41BC.tmp 100 PID 864 wrote to memory of 4404 864 41BC.tmp 100 PID 864 wrote to memory of 4404 864 41BC.tmp 100 PID 4404 wrote to memory of 2352 4404 420A.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"23⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"24⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"25⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"26⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"27⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"28⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"29⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"30⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"31⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"32⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"33⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"34⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"35⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"36⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"37⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"38⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"39⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"40⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"41⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"42⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"43⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"44⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"45⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"46⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"47⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"48⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"49⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"50⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"51⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"52⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"53⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"54⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"55⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"56⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"57⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"58⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"59⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"60⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"61⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"62⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"63⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"64⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"65⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"66⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"67⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"68⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"69⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"70⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"71⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"73⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"74⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"75⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"76⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"77⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"78⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"79⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"80⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"81⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"82⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"83⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"84⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"85⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"86⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"87⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"88⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"89⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"90⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"91⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"92⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"93⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"94⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"95⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"96⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"97⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"99⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"100⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"101⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"102⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"103⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"104⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"105⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"106⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"107⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"108⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"109⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"110⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"111⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"112⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"113⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"115⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"116⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"117⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"118⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"119⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"120⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"121⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"122⤵PID:1012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-