Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
-
Size
530KB
-
MD5
57efef07b1fd87276a83d5023f41c219
-
SHA1
cdd25ebe513361828814e618933d8c10d7860cde
-
SHA256
80b8d68f1522d97165c98c7ab89c2a61ffaaf0be63c34efdda7ecb1cb817f7a1
-
SHA512
a6bd651b7d23b8ca84d70a4e37b4f7e4cfae24c8712e7af9163cbdaa55908e710b71f1bed8ae018dc700ad5eb80cd30c8ea79ff90076b232757791dad23bdb17
-
SSDEEP
12288:AU5rCOTeio8KodUbL+o5qcPgPfNZulFVg0M1:AUQOJo8KZX+o9I3NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3112 9683.tmp 904 973F.tmp 3380 97CB.tmp 2660 9858.tmp 756 98B6.tmp 1172 9933.tmp 3240 99A0.tmp 3708 9A0D.tmp 5048 9A6B.tmp 3236 9AE8.tmp 4304 9B84.tmp 3108 9C11.tmp 4432 9CBD.tmp 2712 9D3A.tmp 3684 9DA7.tmp 2512 9E53.tmp 2196 9ED0.tmp 2276 9F5D.tmp 3552 9FBA.tmp 1340 A047.tmp 5036 A0D4.tmp 396 A151.tmp 3488 A1AE.tmp 4920 A22B.tmp 2424 A2B8.tmp 4500 A335.tmp 1788 A3D1.tmp 1192 A44E.tmp 1144 A49C.tmp 1680 A4FA.tmp 2264 A568.tmp 3712 A5E5.tmp 376 A671.tmp 3548 A6BF.tmp 1684 A70D.tmp 3232 A76B.tmp 2380 A7C9.tmp 1660 A817.tmp 212 A875.tmp 2404 A8D3.tmp 4972 A930.tmp 2556 A98E.tmp 880 A9DC.tmp 2508 AA3A.tmp 5024 AA98.tmp 372 AAF5.tmp 1528 AB53.tmp 3764 ABB1.tmp 4372 AC0F.tmp 4388 AC5D.tmp 740 ACAB.tmp 3516 AD09.tmp 3480 AD76.tmp 3068 ADC4.tmp 4012 AE22.tmp 968 AE80.tmp 1168 AECE.tmp 1228 AF2C.tmp 3148 AF7A.tmp 2576 AFD7.tmp 2660 B035.tmp 756 B093.tmp 2108 B0E1.tmp 1720 B13F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 3112 1848 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 83 PID 1848 wrote to memory of 3112 1848 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 83 PID 1848 wrote to memory of 3112 1848 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 83 PID 3112 wrote to memory of 904 3112 9683.tmp 85 PID 3112 wrote to memory of 904 3112 9683.tmp 85 PID 3112 wrote to memory of 904 3112 9683.tmp 85 PID 904 wrote to memory of 3380 904 973F.tmp 87 PID 904 wrote to memory of 3380 904 973F.tmp 87 PID 904 wrote to memory of 3380 904 973F.tmp 87 PID 3380 wrote to memory of 2660 3380 97CB.tmp 88 PID 3380 wrote to memory of 2660 3380 97CB.tmp 88 PID 3380 wrote to memory of 2660 3380 97CB.tmp 88 PID 2660 wrote to memory of 756 2660 9858.tmp 89 PID 2660 wrote to memory of 756 2660 9858.tmp 89 PID 2660 wrote to memory of 756 2660 9858.tmp 89 PID 756 wrote to memory of 1172 756 98B6.tmp 90 PID 756 wrote to memory of 1172 756 98B6.tmp 90 PID 756 wrote to memory of 1172 756 98B6.tmp 90 PID 1172 wrote to memory of 3240 1172 9933.tmp 91 PID 1172 wrote to memory of 3240 1172 9933.tmp 91 PID 1172 wrote to memory of 3240 1172 9933.tmp 91 PID 3240 wrote to memory of 3708 3240 99A0.tmp 92 PID 3240 wrote to memory of 3708 3240 99A0.tmp 92 PID 3240 wrote to memory of 3708 3240 99A0.tmp 92 PID 3708 wrote to memory of 5048 3708 9A0D.tmp 93 PID 3708 wrote to memory of 5048 3708 9A0D.tmp 93 PID 3708 wrote to memory of 5048 3708 9A0D.tmp 93 PID 5048 wrote to memory of 3236 5048 9A6B.tmp 94 PID 5048 wrote to memory of 3236 5048 9A6B.tmp 94 PID 5048 wrote to memory of 3236 5048 9A6B.tmp 94 PID 3236 wrote to memory of 4304 3236 9AE8.tmp 95 PID 3236 wrote to memory of 4304 3236 9AE8.tmp 95 PID 3236 wrote to memory of 4304 3236 9AE8.tmp 95 PID 4304 wrote to memory of 3108 4304 9B84.tmp 96 PID 4304 wrote to memory of 3108 4304 9B84.tmp 96 PID 4304 wrote to memory of 3108 4304 9B84.tmp 96 PID 3108 wrote to memory of 4432 3108 9C11.tmp 97 PID 3108 wrote to memory of 4432 3108 9C11.tmp 97 PID 3108 wrote to memory of 4432 3108 9C11.tmp 97 PID 4432 wrote to memory of 2712 4432 9CBD.tmp 98 PID 4432 wrote to memory of 2712 4432 9CBD.tmp 98 PID 4432 wrote to memory of 2712 4432 9CBD.tmp 98 PID 2712 wrote to memory of 3684 2712 9D3A.tmp 99 PID 2712 wrote to memory of 3684 2712 9D3A.tmp 99 PID 2712 wrote to memory of 3684 2712 9D3A.tmp 99 PID 3684 wrote to memory of 2512 3684 9DA7.tmp 100 PID 3684 wrote to memory of 2512 3684 9DA7.tmp 100 PID 3684 wrote to memory of 2512 3684 9DA7.tmp 100 PID 2512 wrote to memory of 2196 2512 9E53.tmp 101 PID 2512 wrote to memory of 2196 2512 9E53.tmp 101 PID 2512 wrote to memory of 2196 2512 9E53.tmp 101 PID 2196 wrote to memory of 2276 2196 9ED0.tmp 102 PID 2196 wrote to memory of 2276 2196 9ED0.tmp 102 PID 2196 wrote to memory of 2276 2196 9ED0.tmp 102 PID 2276 wrote to memory of 3552 2276 9F5D.tmp 103 PID 2276 wrote to memory of 3552 2276 9F5D.tmp 103 PID 2276 wrote to memory of 3552 2276 9F5D.tmp 103 PID 3552 wrote to memory of 1340 3552 9FBA.tmp 104 PID 3552 wrote to memory of 1340 3552 9FBA.tmp 104 PID 3552 wrote to memory of 1340 3552 9FBA.tmp 104 PID 1340 wrote to memory of 5036 1340 A047.tmp 105 PID 1340 wrote to memory of 5036 1340 A047.tmp 105 PID 1340 wrote to memory of 5036 1340 A047.tmp 105 PID 5036 wrote to memory of 396 5036 A0D4.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"23⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"24⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"25⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"26⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"27⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"28⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"29⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"30⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"31⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"32⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"33⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"34⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"35⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"36⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"37⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"38⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"39⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"40⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"41⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"42⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"43⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"44⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"45⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"46⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"47⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"48⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"49⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"50⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"51⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"52⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"53⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"54⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"55⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"56⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"57⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"58⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"59⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"60⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"61⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"62⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"63⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"64⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"65⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"66⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"67⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"68⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"69⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"70⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"71⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"72⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"73⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"74⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"75⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"76⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"77⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"78⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"79⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"80⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"81⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"82⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"83⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"84⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"85⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"86⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"87⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"88⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"89⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"90⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"92⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"93⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"94⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"95⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"96⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"97⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"98⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"99⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"100⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"101⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"102⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"103⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"104⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"106⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"107⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"108⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"109⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"110⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"111⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"112⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"113⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"114⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"115⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"116⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"117⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"118⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"119⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"120⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"121⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-