Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe
-
Size
488KB
-
MD5
7a48dadf40196ae0700db6718bed71e4
-
SHA1
58df6d71b44a14d9a985a73cbc7108e01614fb49
-
SHA256
21193d6064696be188c1e91af3ced94ebe48938c8cef3deef91f4c531c65c9ab
-
SHA512
7a7e2369fa075054cd9b0b2af56e6ced578686143b2d143291c9614c203acb0e2994ec615e3ed01bf6c207f891ff6d9ebac20091faa38d5e371af794a345082d
-
SSDEEP
12288:/U5rCOTeiDV3T60C9UI0fbzJpD3vVbNZ:/UQOJDVWnGv/VbN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3520 9DD6.tmp 2272 9EFF.tmp 2956 A018.tmp 3748 A103.tmp 1192 A1ED.tmp 4780 A2D7.tmp 4072 A3D1.tmp 4456 A884.tmp 1056 A9DC.tmp 5020 AAB7.tmp 5076 AB72.tmp 972 AC1E.tmp 2120 ACCA.tmp 4488 AD76.tmp 4184 AE32.tmp 4420 AEED.tmp 3084 AFB8.tmp 644 B054.tmp 4668 B1CB.tmp 3232 B287.tmp 1292 B333.tmp 696 B3CF.tmp 3612 B4B9.tmp 1916 B575.tmp 1772 B650.tmp 4912 B71B.tmp 3568 B7F6.tmp 1340 B8FF.tmp 1524 B99B.tmp 3724 BA76.tmp 3104 BB51.tmp 3060 BC0C.tmp 3412 BCA9.tmp 1680 BD64.tmp 2928 BDD2.tmp 2224 BE4F.tmp 3188 BF1A.tmp 3160 BFB6.tmp 4972 C033.tmp 2668 C0C0.tmp 4048 C15C.tmp 5016 C1F8.tmp 3472 C285.tmp 2352 C311.tmp 1368 C39E.tmp 3236 C41B.tmp 2076 C4F6.tmp 1548 C5A2.tmp 4840 C61F.tmp 3120 C68C.tmp 2444 C719.tmp 1664 C7A5.tmp 1812 C861.tmp 5032 C8CE.tmp 4368 C93B.tmp 3184 C9F7.tmp 1868 CA84.tmp 4576 CB01.tmp 3608 CBEB.tmp 1048 CC87.tmp 2272 CD23.tmp 2436 CDA0.tmp 2060 CE5C.tmp 3336 CF17.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4188 wrote to memory of 3520 4188 2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe 84 PID 4188 wrote to memory of 3520 4188 2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe 84 PID 4188 wrote to memory of 3520 4188 2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe 84 PID 3520 wrote to memory of 2272 3520 9DD6.tmp 85 PID 3520 wrote to memory of 2272 3520 9DD6.tmp 85 PID 3520 wrote to memory of 2272 3520 9DD6.tmp 85 PID 2272 wrote to memory of 2956 2272 9EFF.tmp 86 PID 2272 wrote to memory of 2956 2272 9EFF.tmp 86 PID 2272 wrote to memory of 2956 2272 9EFF.tmp 86 PID 2956 wrote to memory of 3748 2956 A018.tmp 87 PID 2956 wrote to memory of 3748 2956 A018.tmp 87 PID 2956 wrote to memory of 3748 2956 A018.tmp 87 PID 3748 wrote to memory of 1192 3748 A103.tmp 88 PID 3748 wrote to memory of 1192 3748 A103.tmp 88 PID 3748 wrote to memory of 1192 3748 A103.tmp 88 PID 1192 wrote to memory of 4780 1192 A1ED.tmp 89 PID 1192 wrote to memory of 4780 1192 A1ED.tmp 89 PID 1192 wrote to memory of 4780 1192 A1ED.tmp 89 PID 4780 wrote to memory of 4072 4780 A2D7.tmp 90 PID 4780 wrote to memory of 4072 4780 A2D7.tmp 90 PID 4780 wrote to memory of 4072 4780 A2D7.tmp 90 PID 4072 wrote to memory of 4456 4072 A3D1.tmp 91 PID 4072 wrote to memory of 4456 4072 A3D1.tmp 91 PID 4072 wrote to memory of 4456 4072 A3D1.tmp 91 PID 4456 wrote to memory of 1056 4456 A884.tmp 92 PID 4456 wrote to memory of 1056 4456 A884.tmp 92 PID 4456 wrote to memory of 1056 4456 A884.tmp 92 PID 1056 wrote to memory of 5020 1056 A9DC.tmp 93 PID 1056 wrote to memory of 5020 1056 A9DC.tmp 93 PID 1056 wrote to memory of 5020 1056 A9DC.tmp 93 PID 5020 wrote to memory of 5076 5020 AAB7.tmp 94 PID 5020 wrote to memory of 5076 5020 AAB7.tmp 94 PID 5020 wrote to memory of 5076 5020 AAB7.tmp 94 PID 5076 wrote to memory of 972 5076 AB72.tmp 95 PID 5076 wrote to memory of 972 5076 AB72.tmp 95 PID 5076 wrote to memory of 972 5076 AB72.tmp 95 PID 972 wrote to memory of 2120 972 AC1E.tmp 96 PID 972 wrote to memory of 2120 972 AC1E.tmp 96 PID 972 wrote to memory of 2120 972 AC1E.tmp 96 PID 2120 wrote to memory of 4488 2120 ACCA.tmp 97 PID 2120 wrote to memory of 4488 2120 ACCA.tmp 97 PID 2120 wrote to memory of 4488 2120 ACCA.tmp 97 PID 4488 wrote to memory of 4184 4488 AD76.tmp 98 PID 4488 wrote to memory of 4184 4488 AD76.tmp 98 PID 4488 wrote to memory of 4184 4488 AD76.tmp 98 PID 4184 wrote to memory of 4420 4184 AE32.tmp 99 PID 4184 wrote to memory of 4420 4184 AE32.tmp 99 PID 4184 wrote to memory of 4420 4184 AE32.tmp 99 PID 4420 wrote to memory of 3084 4420 AEED.tmp 100 PID 4420 wrote to memory of 3084 4420 AEED.tmp 100 PID 4420 wrote to memory of 3084 4420 AEED.tmp 100 PID 3084 wrote to memory of 644 3084 AFB8.tmp 101 PID 3084 wrote to memory of 644 3084 AFB8.tmp 101 PID 3084 wrote to memory of 644 3084 AFB8.tmp 101 PID 644 wrote to memory of 4668 644 B054.tmp 102 PID 644 wrote to memory of 4668 644 B054.tmp 102 PID 644 wrote to memory of 4668 644 B054.tmp 102 PID 4668 wrote to memory of 3232 4668 B1CB.tmp 103 PID 4668 wrote to memory of 3232 4668 B1CB.tmp 103 PID 4668 wrote to memory of 3232 4668 B1CB.tmp 103 PID 3232 wrote to memory of 1292 3232 B287.tmp 104 PID 3232 wrote to memory of 1292 3232 B287.tmp 104 PID 3232 wrote to memory of 1292 3232 B287.tmp 104 PID 1292 wrote to memory of 696 1292 B333.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_7a48dadf40196ae0700db6718bed71e4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"23⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"24⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"25⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"26⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"27⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"28⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"29⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"30⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"31⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"32⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"33⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"34⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"35⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"36⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"37⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"38⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"39⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"40⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"41⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"42⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"43⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"44⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"45⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"46⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"47⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"48⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"49⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"50⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"51⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"52⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"53⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"54⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"55⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"56⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"57⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"58⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"59⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"60⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"61⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"62⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"63⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"64⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"65⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"66⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"67⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"68⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"69⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"70⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"71⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"72⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"73⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"75⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"76⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"77⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"78⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"79⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"80⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"81⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"82⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"83⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"84⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"85⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"86⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"87⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"88⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"89⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"90⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"91⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"92⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"93⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"94⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"95⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"96⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"97⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"98⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"99⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"100⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"101⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"102⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"103⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"104⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"105⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"106⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"107⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"108⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"109⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"110⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"111⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"112⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"113⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"114⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"115⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"116⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"117⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"118⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"119⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"120⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"121⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-