Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe
-
Size
529KB
-
MD5
6d4c8992826ddfd519cf50cc8955d054
-
SHA1
9eda9f8fac8f51dc07cb6dacd09822f2a80fe734
-
SHA256
229001ebb2903b8f9d8771845428195c38a6c6a20c8e8c6fb6df380ab487f10b
-
SHA512
f23e6c5c150825a9352f56b8243b0a3af3d950d6e99722fce869f4e59e15c13e67706c740659c5acb4f9ed79701e304c672d97b1e79a0c3f0147491d79a2df00
-
SSDEEP
12288:NU5rCOTeijrqj+/JZywUi7x1RTZwlH4Hp:NUQOJjrqj2ywUidzTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
637D.tmp6419.tmp64A5.tmp6532.tmp65AF.tmp661C.tmp668A.tmp66F7.tmp6765.tmp67E2.tmp683F.tmp68AD.tmp68FB.tmp6968.tmp69C6.tmp6A14.tmp6A72.tmp6ADF.tmp6B6C.tmp6BD9.tmp6C47.tmp6CC4.tmp6D21.tmp6D7F.tmp6DCD.tmp6E3B.tmp6E98.tmp6F06.tmp6F63.tmp6FD1.tmp701F.tmp70AC.tmp7119.tmp7177.tmp71D4.tmp7232.tmp7280.tmp72DE.tmp732C.tmp737A.tmp73D8.tmp7426.tmp7484.tmp74D2.tmp7530.tmp757E.tmp75DC.tmp762A.tmp7678.tmp76C6.tmp7714.tmp7762.tmp77C0.tmp780E.tmp786C.tmp78CA.tmp7927.tmp7976.tmp79C4.tmp7A21.tmp7A7F.tmp7ADD.tmp7B3B.tmp7B98.tmppid process 2440 637D.tmp 3612 6419.tmp 3260 64A5.tmp 1176 6532.tmp 2416 65AF.tmp 4724 661C.tmp 2848 668A.tmp 3824 66F7.tmp 4252 6765.tmp 1356 67E2.tmp 4732 683F.tmp 4996 68AD.tmp 3312 68FB.tmp 3252 6968.tmp 2336 69C6.tmp 1608 6A14.tmp 216 6A72.tmp 744 6ADF.tmp 5084 6B6C.tmp 1684 6BD9.tmp 1252 6C47.tmp 1400 6CC4.tmp 2944 6D21.tmp 4584 6D7F.tmp 3032 6DCD.tmp 1016 6E3B.tmp 944 6E98.tmp 1756 6F06.tmp 4736 6F63.tmp 5012 6FD1.tmp 1784 701F.tmp 2244 70AC.tmp 3656 7119.tmp 3196 7177.tmp 3716 71D4.tmp 4120 7232.tmp 2460 7280.tmp 4336 72DE.tmp 1380 732C.tmp 2680 737A.tmp 3900 73D8.tmp 2440 7426.tmp 3160 7484.tmp 1412 74D2.tmp 1908 7530.tmp 1912 757E.tmp 4364 75DC.tmp 1780 762A.tmp 4008 7678.tmp 3784 76C6.tmp 4140 7714.tmp 1988 7762.tmp 3964 77C0.tmp 4528 780E.tmp 664 786C.tmp 1324 78CA.tmp 3620 7927.tmp 2140 7976.tmp 4128 79C4.tmp 3600 7A21.tmp 4204 7A7F.tmp 3988 7ADD.tmp 1184 7B3B.tmp 1484 7B98.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe637D.tmp6419.tmp64A5.tmp6532.tmp65AF.tmp661C.tmp668A.tmp66F7.tmp6765.tmp67E2.tmp683F.tmp68AD.tmp68FB.tmp6968.tmp69C6.tmp6A14.tmp6A72.tmp6ADF.tmp6B6C.tmp6BD9.tmp6C47.tmpdescription pid process target process PID 3948 wrote to memory of 2440 3948 2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe 637D.tmp PID 3948 wrote to memory of 2440 3948 2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe 637D.tmp PID 3948 wrote to memory of 2440 3948 2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe 637D.tmp PID 2440 wrote to memory of 3612 2440 637D.tmp 6419.tmp PID 2440 wrote to memory of 3612 2440 637D.tmp 6419.tmp PID 2440 wrote to memory of 3612 2440 637D.tmp 6419.tmp PID 3612 wrote to memory of 3260 3612 6419.tmp 64A5.tmp PID 3612 wrote to memory of 3260 3612 6419.tmp 64A5.tmp PID 3612 wrote to memory of 3260 3612 6419.tmp 64A5.tmp PID 3260 wrote to memory of 1176 3260 64A5.tmp 6532.tmp PID 3260 wrote to memory of 1176 3260 64A5.tmp 6532.tmp PID 3260 wrote to memory of 1176 3260 64A5.tmp 6532.tmp PID 1176 wrote to memory of 2416 1176 6532.tmp 65AF.tmp PID 1176 wrote to memory of 2416 1176 6532.tmp 65AF.tmp PID 1176 wrote to memory of 2416 1176 6532.tmp 65AF.tmp PID 2416 wrote to memory of 4724 2416 65AF.tmp 661C.tmp PID 2416 wrote to memory of 4724 2416 65AF.tmp 661C.tmp PID 2416 wrote to memory of 4724 2416 65AF.tmp 661C.tmp PID 4724 wrote to memory of 2848 4724 661C.tmp 668A.tmp PID 4724 wrote to memory of 2848 4724 661C.tmp 668A.tmp PID 4724 wrote to memory of 2848 4724 661C.tmp 668A.tmp PID 2848 wrote to memory of 3824 2848 668A.tmp 66F7.tmp PID 2848 wrote to memory of 3824 2848 668A.tmp 66F7.tmp PID 2848 wrote to memory of 3824 2848 668A.tmp 66F7.tmp PID 3824 wrote to memory of 4252 3824 66F7.tmp 6765.tmp PID 3824 wrote to memory of 4252 3824 66F7.tmp 6765.tmp PID 3824 wrote to memory of 4252 3824 66F7.tmp 6765.tmp PID 4252 wrote to memory of 1356 4252 6765.tmp 67E2.tmp PID 4252 wrote to memory of 1356 4252 6765.tmp 67E2.tmp PID 4252 wrote to memory of 1356 4252 6765.tmp 67E2.tmp PID 1356 wrote to memory of 4732 1356 67E2.tmp 683F.tmp PID 1356 wrote to memory of 4732 1356 67E2.tmp 683F.tmp PID 1356 wrote to memory of 4732 1356 67E2.tmp 683F.tmp PID 4732 wrote to memory of 4996 4732 683F.tmp 68AD.tmp PID 4732 wrote to memory of 4996 4732 683F.tmp 68AD.tmp PID 4732 wrote to memory of 4996 4732 683F.tmp 68AD.tmp PID 4996 wrote to memory of 3312 4996 68AD.tmp 68FB.tmp PID 4996 wrote to memory of 3312 4996 68AD.tmp 68FB.tmp PID 4996 wrote to memory of 3312 4996 68AD.tmp 68FB.tmp PID 3312 wrote to memory of 3252 3312 68FB.tmp 6968.tmp PID 3312 wrote to memory of 3252 3312 68FB.tmp 6968.tmp PID 3312 wrote to memory of 3252 3312 68FB.tmp 6968.tmp PID 3252 wrote to memory of 2336 3252 6968.tmp 69C6.tmp PID 3252 wrote to memory of 2336 3252 6968.tmp 69C6.tmp PID 3252 wrote to memory of 2336 3252 6968.tmp 69C6.tmp PID 2336 wrote to memory of 1608 2336 69C6.tmp 6A14.tmp PID 2336 wrote to memory of 1608 2336 69C6.tmp 6A14.tmp PID 2336 wrote to memory of 1608 2336 69C6.tmp 6A14.tmp PID 1608 wrote to memory of 216 1608 6A14.tmp 6A72.tmp PID 1608 wrote to memory of 216 1608 6A14.tmp 6A72.tmp PID 1608 wrote to memory of 216 1608 6A14.tmp 6A72.tmp PID 216 wrote to memory of 744 216 6A72.tmp 6ADF.tmp PID 216 wrote to memory of 744 216 6A72.tmp 6ADF.tmp PID 216 wrote to memory of 744 216 6A72.tmp 6ADF.tmp PID 744 wrote to memory of 5084 744 6ADF.tmp 6B6C.tmp PID 744 wrote to memory of 5084 744 6ADF.tmp 6B6C.tmp PID 744 wrote to memory of 5084 744 6ADF.tmp 6B6C.tmp PID 5084 wrote to memory of 1684 5084 6B6C.tmp 6BD9.tmp PID 5084 wrote to memory of 1684 5084 6B6C.tmp 6BD9.tmp PID 5084 wrote to memory of 1684 5084 6B6C.tmp 6BD9.tmp PID 1684 wrote to memory of 1252 1684 6BD9.tmp 6C47.tmp PID 1684 wrote to memory of 1252 1684 6BD9.tmp 6C47.tmp PID 1684 wrote to memory of 1252 1684 6BD9.tmp 6C47.tmp PID 1252 wrote to memory of 1400 1252 6C47.tmp 6CC4.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_6d4c8992826ddfd519cf50cc8955d054_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"23⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"24⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"25⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"26⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"27⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"28⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"29⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"30⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"31⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"32⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"33⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"34⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"35⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"36⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"37⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"38⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"39⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"40⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"41⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"42⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"43⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"44⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"45⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"46⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"47⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"48⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"49⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"50⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"51⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"52⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"53⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"54⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"55⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"56⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"57⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"58⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"59⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"60⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"61⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"62⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"63⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"64⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"65⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"66⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"67⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"68⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"69⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"70⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"71⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"72⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"73⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"74⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"75⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"76⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"77⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"78⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"79⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"80⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"81⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"82⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"83⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"84⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"85⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"86⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"87⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"88⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"89⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"90⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"91⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"92⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"93⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"94⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"95⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"96⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"97⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"98⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"99⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"100⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"101⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"102⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"103⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"104⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"105⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"106⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"107⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"108⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"109⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"110⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"111⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"112⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"113⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"114⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"115⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"116⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"117⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"118⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"119⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"120⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"121⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"122⤵PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-