Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe
Resource
win7-20240319-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe
-
Size
536KB
-
MD5
d8e0e1b3011a28a8614651d9d8fbc46d
-
SHA1
dd2795d8acacc2fd45a1ec9e50eb172af96b78e8
-
SHA256
39408fbca19f6cd5b82c55d09290420569b7e5f1914839ee6a1e6bbb01142712
-
SHA512
17cd578e2092b2eaecda53cd1902cdd77c585f82d6b06de979fae0fedbbaf3d9d21c50f7e662645431979e8db5b1d6a6ee4e1f8e10d4b18b33fecf74b58576d1
-
SSDEEP
12288:wU5rCOTeiU1TmKcYetr56Pi0uH/93qtIZxVJ0ZT9:wUQOJUkKcYeFsP/uF3yIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4044 5C0A.tmp 732 5CB6.tmp 3748 5D72.tmp 540 5E2D.tmp 3052 5ED9.tmp 3276 5F66.tmp 4812 6012.tmp 4332 606F.tmp 516 610C.tmp 1132 6189.tmp 3156 6215.tmp 2168 6292.tmp 4244 62F0.tmp 4928 637D.tmp 1248 6409.tmp 3976 6477.tmp 2340 6503.tmp 2024 6571.tmp 2672 660D.tmp 3968 66A9.tmp 4600 6726.tmp 3556 67C2.tmp 1920 685F.tmp 1276 68EB.tmp 3548 6987.tmp 3604 69F5.tmp 4992 6AA1.tmp 3672 6B3D.tmp 2496 6BD9.tmp 324 6C66.tmp 3596 6CD3.tmp 2276 6D50.tmp 1624 6DBE.tmp 4224 6E2B.tmp 4084 6E79.tmp 5088 6EC7.tmp 1568 6F15.tmp 2488 6F73.tmp 4152 6FD1.tmp 4784 701F.tmp 1400 706D.tmp 4428 70BB.tmp 4236 7109.tmp 2160 7157.tmp 3216 71A6.tmp 1468 71F4.tmp 2536 7251.tmp 1208 72A0.tmp 1248 72EE.tmp 1608 733C.tmp 1480 738A.tmp 816 73D8.tmp 1672 7426.tmp 4832 7474.tmp 2672 74C2.tmp 4908 7511.tmp 1120 755F.tmp 1768 75AD.tmp 396 761A.tmp 4448 7688.tmp 2624 76D6.tmp 3108 7733.tmp 456 77A1.tmp 752 77FF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 4044 2612 2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe 86 PID 2612 wrote to memory of 4044 2612 2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe 86 PID 2612 wrote to memory of 4044 2612 2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe 86 PID 4044 wrote to memory of 732 4044 5C0A.tmp 87 PID 4044 wrote to memory of 732 4044 5C0A.tmp 87 PID 4044 wrote to memory of 732 4044 5C0A.tmp 87 PID 732 wrote to memory of 3748 732 5CB6.tmp 88 PID 732 wrote to memory of 3748 732 5CB6.tmp 88 PID 732 wrote to memory of 3748 732 5CB6.tmp 88 PID 3748 wrote to memory of 540 3748 5D72.tmp 90 PID 3748 wrote to memory of 540 3748 5D72.tmp 90 PID 3748 wrote to memory of 540 3748 5D72.tmp 90 PID 540 wrote to memory of 3052 540 5E2D.tmp 92 PID 540 wrote to memory of 3052 540 5E2D.tmp 92 PID 540 wrote to memory of 3052 540 5E2D.tmp 92 PID 3052 wrote to memory of 3276 3052 5ED9.tmp 93 PID 3052 wrote to memory of 3276 3052 5ED9.tmp 93 PID 3052 wrote to memory of 3276 3052 5ED9.tmp 93 PID 3276 wrote to memory of 4812 3276 5F66.tmp 95 PID 3276 wrote to memory of 4812 3276 5F66.tmp 95 PID 3276 wrote to memory of 4812 3276 5F66.tmp 95 PID 4812 wrote to memory of 4332 4812 6012.tmp 96 PID 4812 wrote to memory of 4332 4812 6012.tmp 96 PID 4812 wrote to memory of 4332 4812 6012.tmp 96 PID 4332 wrote to memory of 516 4332 606F.tmp 97 PID 4332 wrote to memory of 516 4332 606F.tmp 97 PID 4332 wrote to memory of 516 4332 606F.tmp 97 PID 516 wrote to memory of 1132 516 610C.tmp 98 PID 516 wrote to memory of 1132 516 610C.tmp 98 PID 516 wrote to memory of 1132 516 610C.tmp 98 PID 1132 wrote to memory of 3156 1132 6189.tmp 99 PID 1132 wrote to memory of 3156 1132 6189.tmp 99 PID 1132 wrote to memory of 3156 1132 6189.tmp 99 PID 3156 wrote to memory of 2168 3156 6215.tmp 100 PID 3156 wrote to memory of 2168 3156 6215.tmp 100 PID 3156 wrote to memory of 2168 3156 6215.tmp 100 PID 2168 wrote to memory of 4244 2168 6292.tmp 101 PID 2168 wrote to memory of 4244 2168 6292.tmp 101 PID 2168 wrote to memory of 4244 2168 6292.tmp 101 PID 4244 wrote to memory of 4928 4244 62F0.tmp 102 PID 4244 wrote to memory of 4928 4244 62F0.tmp 102 PID 4244 wrote to memory of 4928 4244 62F0.tmp 102 PID 4928 wrote to memory of 1248 4928 637D.tmp 103 PID 4928 wrote to memory of 1248 4928 637D.tmp 103 PID 4928 wrote to memory of 1248 4928 637D.tmp 103 PID 1248 wrote to memory of 3976 1248 6409.tmp 104 PID 1248 wrote to memory of 3976 1248 6409.tmp 104 PID 1248 wrote to memory of 3976 1248 6409.tmp 104 PID 3976 wrote to memory of 2340 3976 6477.tmp 105 PID 3976 wrote to memory of 2340 3976 6477.tmp 105 PID 3976 wrote to memory of 2340 3976 6477.tmp 105 PID 2340 wrote to memory of 2024 2340 6503.tmp 106 PID 2340 wrote to memory of 2024 2340 6503.tmp 106 PID 2340 wrote to memory of 2024 2340 6503.tmp 106 PID 2024 wrote to memory of 2672 2024 6571.tmp 107 PID 2024 wrote to memory of 2672 2024 6571.tmp 107 PID 2024 wrote to memory of 2672 2024 6571.tmp 107 PID 2672 wrote to memory of 3968 2672 660D.tmp 108 PID 2672 wrote to memory of 3968 2672 660D.tmp 108 PID 2672 wrote to memory of 3968 2672 660D.tmp 108 PID 3968 wrote to memory of 4600 3968 66A9.tmp 109 PID 3968 wrote to memory of 4600 3968 66A9.tmp 109 PID 3968 wrote to memory of 4600 3968 66A9.tmp 109 PID 4600 wrote to memory of 3556 4600 6726.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_d8e0e1b3011a28a8614651d9d8fbc46d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"23⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"24⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"25⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"26⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"27⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"28⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"29⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"30⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"31⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"32⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"33⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"34⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"35⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"36⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"37⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"38⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"39⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"40⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"41⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"42⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"43⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"44⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"45⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"46⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"47⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"48⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"49⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"50⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"51⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"52⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"53⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"54⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"55⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"56⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"57⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"58⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"59⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"60⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"61⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"62⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"63⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"64⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"65⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"66⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"67⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"68⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"69⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"70⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"71⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"72⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"73⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"74⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"75⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"76⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"77⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"78⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"79⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"80⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"81⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"82⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"83⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"84⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"85⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"86⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"87⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"88⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"89⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"91⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"92⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"93⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"94⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"95⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"96⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"97⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"98⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"99⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"100⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"101⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"102⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"103⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"104⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"105⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"106⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"107⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"108⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"109⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"110⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"111⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"112⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"113⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"114⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"115⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"116⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"117⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"118⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"119⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"120⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"121⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"122⤵PID:412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-