Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_746cc061343d301d6940348023eed577_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_746cc061343d301d6940348023eed577_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-06_746cc061343d301d6940348023eed577_mafia.exe
-
Size
536KB
-
MD5
746cc061343d301d6940348023eed577
-
SHA1
7fa1adc53c7e1f2c9b0943cfd612591b220d357b
-
SHA256
b3ea21db7b916e59ccdb1a5c75733987b052ab99f1ab14f2eea55afc71a106be
-
SHA512
8057cfd2f881c741b06c00ebdf8b3c345b85dbce4ac96153f44893629db2feb6724db397c69c6eb030941ea2c9754a12c63a3448ead628fe19bd42a2ab2e78e7
-
SSDEEP
12288:wU5rCOTeiU7xACy023uIdmSSmgznD4ugDIZxVJ0ZT9:wUQOJU7xACmeIdivaIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3000 C61F.tmp 2976 C69C.tmp 3496 C6F9.tmp 1816 C91C.tmp 2536 C97A.tmp 4044 CAF1.tmp 2440 CBCC.tmp 4644 CC49.tmp 3004 CCB6.tmp 400 CD23.tmp 3492 CD81.tmp 1624 CFD3.tmp 4052 D050.tmp 4264 D0CD.tmp 4020 D169.tmp 1668 D1D7.tmp 2296 D263.tmp 1116 D438.tmp 2156 D4A5.tmp 3164 D513.tmp 2300 D5FD.tmp 5012 D65B.tmp 4628 D707.tmp 1036 D793.tmp 372 D84F.tmp 2248 D978.tmp 4040 DA91.tmp 3408 DB3D.tmp 2928 DC75.tmp 4252 DCF2.tmp 3508 DDEC.tmp 4832 DE89.tmp 4868 DF73.tmp 4428 DFE0.tmp 2576 E04E.tmp 632 E0AB.tmp 1908 E119.tmp 4544 E196.tmp 4392 E1F4.tmp 4940 E261.tmp 1832 E2CE.tmp 3356 E35B.tmp 752 E3F7.tmp 4580 E465.tmp 992 E4C2.tmp 4100 E55F.tmp 3496 E5BC.tmp 2872 E60A.tmp 1252 E678.tmp 1540 E6D6.tmp 3560 E743.tmp 3128 E7A1.tmp 1148 E7EF.tmp 1124 E83D.tmp 4916 E8AA.tmp 3460 E8F8.tmp 4468 E956.tmp 1192 E9B4.tmp 3936 EA12.tmp 2568 EA6F.tmp 1692 EABE.tmp 2144 EB1B.tmp 880 EB69.tmp 1116 EBB8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3000 1612 2024-07-06_746cc061343d301d6940348023eed577_mafia.exe 235 PID 1612 wrote to memory of 3000 1612 2024-07-06_746cc061343d301d6940348023eed577_mafia.exe 235 PID 1612 wrote to memory of 3000 1612 2024-07-06_746cc061343d301d6940348023eed577_mafia.exe 235 PID 3000 wrote to memory of 2976 3000 C61F.tmp 86 PID 3000 wrote to memory of 2976 3000 C61F.tmp 86 PID 3000 wrote to memory of 2976 3000 C61F.tmp 86 PID 2976 wrote to memory of 3496 2976 C69C.tmp 131 PID 2976 wrote to memory of 3496 2976 C69C.tmp 131 PID 2976 wrote to memory of 3496 2976 C69C.tmp 131 PID 3496 wrote to memory of 1816 3496 C6F9.tmp 88 PID 3496 wrote to memory of 1816 3496 C6F9.tmp 88 PID 3496 wrote to memory of 1816 3496 C6F9.tmp 88 PID 1816 wrote to memory of 2536 1816 C91C.tmp 441 PID 1816 wrote to memory of 2536 1816 C91C.tmp 441 PID 1816 wrote to memory of 2536 1816 C91C.tmp 441 PID 2536 wrote to memory of 4044 2536 C97A.tmp 440 PID 2536 wrote to memory of 4044 2536 C97A.tmp 440 PID 2536 wrote to memory of 4044 2536 C97A.tmp 440 PID 4044 wrote to memory of 2440 4044 CAF1.tmp 91 PID 4044 wrote to memory of 2440 4044 CAF1.tmp 91 PID 4044 wrote to memory of 2440 4044 CAF1.tmp 91 PID 2440 wrote to memory of 4644 2440 CBCC.tmp 92 PID 2440 wrote to memory of 4644 2440 CBCC.tmp 92 PID 2440 wrote to memory of 4644 2440 CBCC.tmp 92 PID 4644 wrote to memory of 3004 4644 CC49.tmp 308 PID 4644 wrote to memory of 3004 4644 CC49.tmp 308 PID 4644 wrote to memory of 3004 4644 CC49.tmp 308 PID 3004 wrote to memory of 400 3004 CCB6.tmp 191 PID 3004 wrote to memory of 400 3004 CCB6.tmp 191 PID 3004 wrote to memory of 400 3004 CCB6.tmp 191 PID 400 wrote to memory of 3492 400 CD23.tmp 95 PID 400 wrote to memory of 3492 400 CD23.tmp 95 PID 400 wrote to memory of 3492 400 CD23.tmp 95 PID 3492 wrote to memory of 1624 3492 CD81.tmp 194 PID 3492 wrote to memory of 1624 3492 CD81.tmp 194 PID 3492 wrote to memory of 1624 3492 CD81.tmp 194 PID 1624 wrote to memory of 4052 1624 CFD3.tmp 97 PID 1624 wrote to memory of 4052 1624 CFD3.tmp 97 PID 1624 wrote to memory of 4052 1624 CFD3.tmp 97 PID 4052 wrote to memory of 4264 4052 D050.tmp 98 PID 4052 wrote to memory of 4264 4052 D050.tmp 98 PID 4052 wrote to memory of 4264 4052 D050.tmp 98 PID 4264 wrote to memory of 4020 4264 D0CD.tmp 99 PID 4264 wrote to memory of 4020 4264 D0CD.tmp 99 PID 4264 wrote to memory of 4020 4264 D0CD.tmp 99 PID 4020 wrote to memory of 1668 4020 D169.tmp 319 PID 4020 wrote to memory of 1668 4020 D169.tmp 319 PID 4020 wrote to memory of 1668 4020 D169.tmp 319 PID 1668 wrote to memory of 2296 1668 D1D7.tmp 101 PID 1668 wrote to memory of 2296 1668 D1D7.tmp 101 PID 1668 wrote to memory of 2296 1668 D1D7.tmp 101 PID 2296 wrote to memory of 1116 2296 D263.tmp 102 PID 2296 wrote to memory of 1116 2296 D263.tmp 102 PID 2296 wrote to memory of 1116 2296 D263.tmp 102 PID 1116 wrote to memory of 2156 1116 D438.tmp 323 PID 1116 wrote to memory of 2156 1116 D438.tmp 323 PID 1116 wrote to memory of 2156 1116 D438.tmp 323 PID 2156 wrote to memory of 3164 2156 D4A5.tmp 104 PID 2156 wrote to memory of 3164 2156 D4A5.tmp 104 PID 2156 wrote to memory of 3164 2156 D4A5.tmp 104 PID 3164 wrote to memory of 2300 3164 D513.tmp 105 PID 3164 wrote to memory of 2300 3164 D513.tmp 105 PID 3164 wrote to memory of 2300 3164 D513.tmp 105 PID 2300 wrote to memory of 5012 2300 D5FD.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_746cc061343d301d6940348023eed577_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_746cc061343d301d6940348023eed577_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"23⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"24⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"25⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"26⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"27⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"28⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"29⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"30⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"31⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"32⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"33⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"34⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"35⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"36⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"37⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"38⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"39⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"40⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"41⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"42⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"43⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"44⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"45⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"46⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"47⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"48⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"49⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"50⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"51⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"52⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"53⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"54⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"55⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"56⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"57⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"58⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"59⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"60⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"61⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"62⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"63⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"64⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"65⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"66⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"67⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"68⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"69⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"70⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"71⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"72⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"73⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"74⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"75⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"76⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"77⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"78⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"79⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"80⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"81⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"82⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"83⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"84⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"85⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"86⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"87⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"88⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"89⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"90⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"91⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"92⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"93⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"94⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"95⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"96⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"97⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"98⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"99⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"100⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"101⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"102⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"103⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"104⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"105⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"106⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"107⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"108⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"109⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"110⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"112⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"113⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"114⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"115⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"116⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"117⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"118⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"119⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"120⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"121⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-