Analysis
-
max time kernel
150s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
-
Size
541KB
-
MD5
b611f4546dd7b1f3832599071e8a10c9
-
SHA1
93d51ffe0354ad0185b1aecac20fc05e1e9c7765
-
SHA256
453b75d39888e860f48e4562de71dc7be2fa4c420035ca8cd6bae8dd08f4a31e
-
SHA512
60e27efb20dfe13efd4c917e1a17a681057ebfc68ccb327063af4639cd27e220e08f0392a263737149f9bc8da60d6d3195d90c497abf19ddcb014ceaeb8989d9
-
SSDEEP
12288:UU5rCOTeifj7YVezgpxdzzlYnm6JQ72ASjrZa73ctO:UUQOJffGxBzXCMKrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3576 3F7A.tmp 744 4006.tmp 388 4093.tmp 2088 412F.tmp 2708 418D.tmp 4272 41EB.tmp 1076 4249.tmp 1600 42C6.tmp 4148 4323.tmp 4808 4381.tmp 4396 43CF.tmp 1872 441D.tmp 5084 446B.tmp 1128 44BA.tmp 456 4517.tmp 2900 45A4.tmp 4392 4621.tmp 3444 467F.tmp 2872 46DC.tmp 1680 472B.tmp 1288 47A8.tmp 3292 4825.tmp 2456 4882.tmp 2748 48F0.tmp 2536 493E.tmp 4108 49BB.tmp 372 4A28.tmp 4056 4A76.tmp 2468 4AD4.tmp 4832 4B51.tmp 3640 4BBE.tmp 2304 4C1C.tmp 4696 4C7A.tmp 4344 4CD8.tmp 4080 4D26.tmp 3904 4D74.tmp 5036 4DC2.tmp 3916 4E10.tmp 4996 4E5E.tmp 4572 4EAC.tmp 2020 4EFB.tmp 4424 4F49.tmp 4244 4F97.tmp 60 4FF5.tmp 1768 5043.tmp 2920 50A0.tmp 612 50FE.tmp 3180 514C.tmp 2788 519A.tmp 3328 51F8.tmp 3692 5246.tmp 3028 52A4.tmp 4372 5302.tmp 4624 5360.tmp 4384 53AE.tmp 2784 53FC.tmp 648 544A.tmp 2428 54A8.tmp 2712 5505.tmp 208 5554.tmp 4476 55B1.tmp 3900 55FF.tmp 2956 564E.tmp 2356 56AB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1416 wrote to memory of 3576 1416 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 81 PID 1416 wrote to memory of 3576 1416 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 81 PID 1416 wrote to memory of 3576 1416 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 81 PID 3576 wrote to memory of 744 3576 3F7A.tmp 82 PID 3576 wrote to memory of 744 3576 3F7A.tmp 82 PID 3576 wrote to memory of 744 3576 3F7A.tmp 82 PID 744 wrote to memory of 388 744 4006.tmp 83 PID 744 wrote to memory of 388 744 4006.tmp 83 PID 744 wrote to memory of 388 744 4006.tmp 83 PID 388 wrote to memory of 2088 388 4093.tmp 84 PID 388 wrote to memory of 2088 388 4093.tmp 84 PID 388 wrote to memory of 2088 388 4093.tmp 84 PID 2088 wrote to memory of 2708 2088 412F.tmp 85 PID 2088 wrote to memory of 2708 2088 412F.tmp 85 PID 2088 wrote to memory of 2708 2088 412F.tmp 85 PID 2708 wrote to memory of 4272 2708 418D.tmp 86 PID 2708 wrote to memory of 4272 2708 418D.tmp 86 PID 2708 wrote to memory of 4272 2708 418D.tmp 86 PID 4272 wrote to memory of 1076 4272 41EB.tmp 87 PID 4272 wrote to memory of 1076 4272 41EB.tmp 87 PID 4272 wrote to memory of 1076 4272 41EB.tmp 87 PID 1076 wrote to memory of 1600 1076 4249.tmp 88 PID 1076 wrote to memory of 1600 1076 4249.tmp 88 PID 1076 wrote to memory of 1600 1076 4249.tmp 88 PID 1600 wrote to memory of 4148 1600 42C6.tmp 89 PID 1600 wrote to memory of 4148 1600 42C6.tmp 89 PID 1600 wrote to memory of 4148 1600 42C6.tmp 89 PID 4148 wrote to memory of 4808 4148 4323.tmp 90 PID 4148 wrote to memory of 4808 4148 4323.tmp 90 PID 4148 wrote to memory of 4808 4148 4323.tmp 90 PID 4808 wrote to memory of 4396 4808 4381.tmp 91 PID 4808 wrote to memory of 4396 4808 4381.tmp 91 PID 4808 wrote to memory of 4396 4808 4381.tmp 91 PID 4396 wrote to memory of 1872 4396 43CF.tmp 92 PID 4396 wrote to memory of 1872 4396 43CF.tmp 92 PID 4396 wrote to memory of 1872 4396 43CF.tmp 92 PID 1872 wrote to memory of 5084 1872 441D.tmp 93 PID 1872 wrote to memory of 5084 1872 441D.tmp 93 PID 1872 wrote to memory of 5084 1872 441D.tmp 93 PID 5084 wrote to memory of 1128 5084 446B.tmp 94 PID 5084 wrote to memory of 1128 5084 446B.tmp 94 PID 5084 wrote to memory of 1128 5084 446B.tmp 94 PID 1128 wrote to memory of 456 1128 44BA.tmp 95 PID 1128 wrote to memory of 456 1128 44BA.tmp 95 PID 1128 wrote to memory of 456 1128 44BA.tmp 95 PID 456 wrote to memory of 2900 456 4517.tmp 96 PID 456 wrote to memory of 2900 456 4517.tmp 96 PID 456 wrote to memory of 2900 456 4517.tmp 96 PID 2900 wrote to memory of 4392 2900 45A4.tmp 97 PID 2900 wrote to memory of 4392 2900 45A4.tmp 97 PID 2900 wrote to memory of 4392 2900 45A4.tmp 97 PID 4392 wrote to memory of 3444 4392 4621.tmp 98 PID 4392 wrote to memory of 3444 4392 4621.tmp 98 PID 4392 wrote to memory of 3444 4392 4621.tmp 98 PID 3444 wrote to memory of 2872 3444 467F.tmp 99 PID 3444 wrote to memory of 2872 3444 467F.tmp 99 PID 3444 wrote to memory of 2872 3444 467F.tmp 99 PID 2872 wrote to memory of 1680 2872 46DC.tmp 100 PID 2872 wrote to memory of 1680 2872 46DC.tmp 100 PID 2872 wrote to memory of 1680 2872 46DC.tmp 100 PID 1680 wrote to memory of 1288 1680 472B.tmp 101 PID 1680 wrote to memory of 1288 1680 472B.tmp 101 PID 1680 wrote to memory of 1288 1680 472B.tmp 101 PID 1288 wrote to memory of 3292 1288 47A8.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"23⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"24⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"25⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"26⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"27⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"28⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"29⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"30⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"31⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"32⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"33⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"34⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"35⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"36⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"37⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"38⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"39⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"40⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"41⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"42⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"43⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"44⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"45⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"46⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"47⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"48⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"49⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"50⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"51⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"52⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"53⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"54⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"55⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"56⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"57⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"58⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"59⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"60⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"61⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"62⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"63⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"64⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"65⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"66⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"67⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"68⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"69⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"70⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"71⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"72⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"73⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"74⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"75⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"76⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"77⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"78⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"79⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"80⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"81⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"82⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"83⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"84⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"85⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"86⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"87⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"88⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"89⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"90⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"91⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"92⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"93⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"94⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"95⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"96⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"97⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"98⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"99⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"100⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"101⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"102⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"104⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"105⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"106⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"107⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"108⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"109⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"110⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"111⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"112⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"113⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"114⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"115⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"116⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"117⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"118⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"119⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"120⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"121⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"122⤵PID:3868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-