Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe
-
Size
529KB
-
MD5
f976af57bf863648f74a06587d110ef9
-
SHA1
939a0ee6e5d9230504c081c9c5d7489152e0d1fa
-
SHA256
2cc9746e345b51b30085d8a7b4c7a81b12773670b45fd83cc71013ff612fa759
-
SHA512
58e7417800afad73bfcdbc75934df8ea7742c33103053473d331f9e30d4f200b0cd5de4e930b130ea9fb2525aa530406a5e7375f948d763eafb900c9955a2b03
-
SSDEEP
12288:NU5rCOTeijJH5bffUih9kprMTZwlH4Hp:NUQOJjrbhXTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4440 4A38.tmp 2340 4AB5.tmp 3560 4B41.tmp 1428 4BAF.tmp 2088 4C0D.tmp 4088 4C7A.tmp 1432 4CF7.tmp 2216 4D55.tmp 3568 4DD2.tmp 1472 4E2F.tmp 3020 4E8D.tmp 4848 4EEB.tmp 4544 4F49.tmp 4304 4FA6.tmp 3372 5004.tmp 4608 5072.tmp 1284 50DF.tmp 2188 514C.tmp 4188 51AA.tmp 3576 5208.tmp 4196 5256.tmp 4936 52E3.tmp 3508 5350.tmp 212 53BD.tmp 2180 541B.tmp 2540 5479.tmp 1240 54E6.tmp 4336 5554.tmp 4444 55A2.tmp 1004 561F.tmp 2824 56BB.tmp 1736 5709.tmp 4112 5767.tmp 2184 57D4.tmp 2712 5822.tmp 2248 5890.tmp 2296 58DE.tmp 724 592C.tmp 4856 598A.tmp 4340 59E7.tmp 1528 5A36.tmp 2228 5A93.tmp 860 5AE1.tmp 4752 5B3F.tmp 3692 5B9D.tmp 3912 5BEB.tmp 1180 5C39.tmp 2320 5C87.tmp 1688 5CD5.tmp 4832 5D24.tmp 4848 5D81.tmp 4544 5DCF.tmp 3948 5E2D.tmp 4464 5E7B.tmp 4624 5ED9.tmp 3572 5F27.tmp 3036 5F75.tmp 2984 5FD3.tmp 2944 6031.tmp 1704 607F.tmp 452 60CD.tmp 4308 612B.tmp 2504 6189.tmp 4264 61E6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4440 1628 2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe 86 PID 1628 wrote to memory of 4440 1628 2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe 86 PID 1628 wrote to memory of 4440 1628 2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe 86 PID 4440 wrote to memory of 2340 4440 4A38.tmp 87 PID 4440 wrote to memory of 2340 4440 4A38.tmp 87 PID 4440 wrote to memory of 2340 4440 4A38.tmp 87 PID 2340 wrote to memory of 3560 2340 4AB5.tmp 88 PID 2340 wrote to memory of 3560 2340 4AB5.tmp 88 PID 2340 wrote to memory of 3560 2340 4AB5.tmp 88 PID 3560 wrote to memory of 1428 3560 4B41.tmp 89 PID 3560 wrote to memory of 1428 3560 4B41.tmp 89 PID 3560 wrote to memory of 1428 3560 4B41.tmp 89 PID 1428 wrote to memory of 2088 1428 4BAF.tmp 90 PID 1428 wrote to memory of 2088 1428 4BAF.tmp 90 PID 1428 wrote to memory of 2088 1428 4BAF.tmp 90 PID 2088 wrote to memory of 4088 2088 4C0D.tmp 92 PID 2088 wrote to memory of 4088 2088 4C0D.tmp 92 PID 2088 wrote to memory of 4088 2088 4C0D.tmp 92 PID 4088 wrote to memory of 1432 4088 4C7A.tmp 94 PID 4088 wrote to memory of 1432 4088 4C7A.tmp 94 PID 4088 wrote to memory of 1432 4088 4C7A.tmp 94 PID 1432 wrote to memory of 2216 1432 4CF7.tmp 95 PID 1432 wrote to memory of 2216 1432 4CF7.tmp 95 PID 1432 wrote to memory of 2216 1432 4CF7.tmp 95 PID 2216 wrote to memory of 3568 2216 4D55.tmp 96 PID 2216 wrote to memory of 3568 2216 4D55.tmp 96 PID 2216 wrote to memory of 3568 2216 4D55.tmp 96 PID 3568 wrote to memory of 1472 3568 4DD2.tmp 97 PID 3568 wrote to memory of 1472 3568 4DD2.tmp 97 PID 3568 wrote to memory of 1472 3568 4DD2.tmp 97 PID 1472 wrote to memory of 3020 1472 4E2F.tmp 98 PID 1472 wrote to memory of 3020 1472 4E2F.tmp 98 PID 1472 wrote to memory of 3020 1472 4E2F.tmp 98 PID 3020 wrote to memory of 4848 3020 4E8D.tmp 99 PID 3020 wrote to memory of 4848 3020 4E8D.tmp 99 PID 3020 wrote to memory of 4848 3020 4E8D.tmp 99 PID 4848 wrote to memory of 4544 4848 4EEB.tmp 100 PID 4848 wrote to memory of 4544 4848 4EEB.tmp 100 PID 4848 wrote to memory of 4544 4848 4EEB.tmp 100 PID 4544 wrote to memory of 4304 4544 4F49.tmp 101 PID 4544 wrote to memory of 4304 4544 4F49.tmp 101 PID 4544 wrote to memory of 4304 4544 4F49.tmp 101 PID 4304 wrote to memory of 3372 4304 4FA6.tmp 102 PID 4304 wrote to memory of 3372 4304 4FA6.tmp 102 PID 4304 wrote to memory of 3372 4304 4FA6.tmp 102 PID 3372 wrote to memory of 4608 3372 5004.tmp 103 PID 3372 wrote to memory of 4608 3372 5004.tmp 103 PID 3372 wrote to memory of 4608 3372 5004.tmp 103 PID 4608 wrote to memory of 1284 4608 5072.tmp 104 PID 4608 wrote to memory of 1284 4608 5072.tmp 104 PID 4608 wrote to memory of 1284 4608 5072.tmp 104 PID 1284 wrote to memory of 2188 1284 50DF.tmp 105 PID 1284 wrote to memory of 2188 1284 50DF.tmp 105 PID 1284 wrote to memory of 2188 1284 50DF.tmp 105 PID 2188 wrote to memory of 4188 2188 514C.tmp 106 PID 2188 wrote to memory of 4188 2188 514C.tmp 106 PID 2188 wrote to memory of 4188 2188 514C.tmp 106 PID 4188 wrote to memory of 3576 4188 51AA.tmp 107 PID 4188 wrote to memory of 3576 4188 51AA.tmp 107 PID 4188 wrote to memory of 3576 4188 51AA.tmp 107 PID 3576 wrote to memory of 4196 3576 5208.tmp 108 PID 3576 wrote to memory of 4196 3576 5208.tmp 108 PID 3576 wrote to memory of 4196 3576 5208.tmp 108 PID 4196 wrote to memory of 4936 4196 5256.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_f976af57bf863648f74a06587d110ef9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"23⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"24⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"25⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"26⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"27⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"28⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"29⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"30⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"31⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"32⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"33⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"34⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"35⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"36⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"37⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"38⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"39⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"40⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"41⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"42⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"43⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"44⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"45⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"46⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"47⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"48⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"49⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"50⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"51⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"52⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"53⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"54⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"55⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"56⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"57⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"58⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"59⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"60⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"61⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"62⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"63⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"64⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"65⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"66⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"67⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"69⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"70⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"71⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"72⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"73⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"74⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"75⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"76⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"77⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"78⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"79⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"80⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"81⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"82⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"83⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"84⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"85⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"86⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"87⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"88⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"89⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"90⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"91⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"92⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"93⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"94⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"95⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"96⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"97⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"98⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"99⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"100⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"102⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"103⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"104⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"106⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"107⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"108⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"109⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"110⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"111⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"112⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"113⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"114⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"115⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"116⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"117⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"118⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"119⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"120⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"121⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"122⤵PID:1920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-