Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 07:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe
-
Size
530KB
-
MD5
2eb9cdf5f26978ddc817ac00645cb87c
-
SHA1
5a3d5c2384e7b1f34994f5fe8e2a66f1c680ba23
-
SHA256
7769bb5bb9bec99af276088e270019a0b889d284560a64a4de804ed88793872b
-
SHA512
1853220dc75bb4e01e328fdde4426ddbe6e3f3f7dbc88c9dd540c7adcea6b50e3a9a3139e720fb1f03b00f16c75e5561ecefcaf6b0ba950857a80b5e8b1ceb4b
-
SSDEEP
12288:AU5rCOTeio0RWyG0QIMg2UDjJ68zfcylNZulFVg0M1:AUQOJo0RWyGtIMujJ3lNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4896 4C8A.tmp 876 4D26.tmp 1020 4DB2.tmp 1504 4E2F.tmp 2160 4EDB.tmp 2800 4F78.tmp 2624 4FE5.tmp 4180 5052.tmp 4668 50CF.tmp 4868 515C.tmp 2840 51BA.tmp 3652 5227.tmp 448 5285.tmp 452 5302.tmp 1856 536F.tmp 1232 540B.tmp 2024 5498.tmp 736 5515.tmp 3528 55A2.tmp 1796 562E.tmp 3544 56AB.tmp 5012 5757.tmp 2504 57E4.tmp 2788 5851.tmp 528 58FD.tmp 3968 5999.tmp 3028 59F7.tmp 4796 5A64.tmp 5068 5B10.tmp 4332 5BAD.tmp 2184 5C0A.tmp 4104 5C87.tmp 3776 5D14.tmp 4772 5D62.tmp 3676 5DC0.tmp 3616 5E1E.tmp 3012 5E6C.tmp 1040 5ED9.tmp 992 5F27.tmp 5104 5F95.tmp 4632 5FE3.tmp 4320 6031.tmp 2180 607F.tmp 3536 60EC.tmp 4452 613A.tmp 5016 61A8.tmp 876 6215.tmp 4316 6283.tmp 2744 62E0.tmp 1476 634E.tmp 2364 639C.tmp 2160 63FA.tmp 1800 6457.tmp 2260 64A5.tmp 3508 6503.tmp 2840 6551.tmp 4940 659F.tmp 1532 65EE.tmp 3392 664B.tmp 4292 6699.tmp 4240 66E8.tmp 1812 6745.tmp 736 67B3.tmp 4616 6810.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4896 2132 2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe 87 PID 2132 wrote to memory of 4896 2132 2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe 87 PID 2132 wrote to memory of 4896 2132 2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe 87 PID 4896 wrote to memory of 876 4896 4C8A.tmp 88 PID 4896 wrote to memory of 876 4896 4C8A.tmp 88 PID 4896 wrote to memory of 876 4896 4C8A.tmp 88 PID 876 wrote to memory of 1020 876 4D26.tmp 89 PID 876 wrote to memory of 1020 876 4D26.tmp 89 PID 876 wrote to memory of 1020 876 4D26.tmp 89 PID 1020 wrote to memory of 1504 1020 4DB2.tmp 90 PID 1020 wrote to memory of 1504 1020 4DB2.tmp 90 PID 1020 wrote to memory of 1504 1020 4DB2.tmp 90 PID 1504 wrote to memory of 2160 1504 4E2F.tmp 92 PID 1504 wrote to memory of 2160 1504 4E2F.tmp 92 PID 1504 wrote to memory of 2160 1504 4E2F.tmp 92 PID 2160 wrote to memory of 2800 2160 4EDB.tmp 94 PID 2160 wrote to memory of 2800 2160 4EDB.tmp 94 PID 2160 wrote to memory of 2800 2160 4EDB.tmp 94 PID 2800 wrote to memory of 2624 2800 4F78.tmp 95 PID 2800 wrote to memory of 2624 2800 4F78.tmp 95 PID 2800 wrote to memory of 2624 2800 4F78.tmp 95 PID 2624 wrote to memory of 4180 2624 4FE5.tmp 97 PID 2624 wrote to memory of 4180 2624 4FE5.tmp 97 PID 2624 wrote to memory of 4180 2624 4FE5.tmp 97 PID 4180 wrote to memory of 4668 4180 5052.tmp 98 PID 4180 wrote to memory of 4668 4180 5052.tmp 98 PID 4180 wrote to memory of 4668 4180 5052.tmp 98 PID 4668 wrote to memory of 4868 4668 50CF.tmp 99 PID 4668 wrote to memory of 4868 4668 50CF.tmp 99 PID 4668 wrote to memory of 4868 4668 50CF.tmp 99 PID 4868 wrote to memory of 2840 4868 515C.tmp 100 PID 4868 wrote to memory of 2840 4868 515C.tmp 100 PID 4868 wrote to memory of 2840 4868 515C.tmp 100 PID 2840 wrote to memory of 3652 2840 51BA.tmp 101 PID 2840 wrote to memory of 3652 2840 51BA.tmp 101 PID 2840 wrote to memory of 3652 2840 51BA.tmp 101 PID 3652 wrote to memory of 448 3652 5227.tmp 102 PID 3652 wrote to memory of 448 3652 5227.tmp 102 PID 3652 wrote to memory of 448 3652 5227.tmp 102 PID 448 wrote to memory of 452 448 5285.tmp 103 PID 448 wrote to memory of 452 448 5285.tmp 103 PID 448 wrote to memory of 452 448 5285.tmp 103 PID 452 wrote to memory of 1856 452 5302.tmp 104 PID 452 wrote to memory of 1856 452 5302.tmp 104 PID 452 wrote to memory of 1856 452 5302.tmp 104 PID 1856 wrote to memory of 1232 1856 536F.tmp 105 PID 1856 wrote to memory of 1232 1856 536F.tmp 105 PID 1856 wrote to memory of 1232 1856 536F.tmp 105 PID 1232 wrote to memory of 2024 1232 540B.tmp 106 PID 1232 wrote to memory of 2024 1232 540B.tmp 106 PID 1232 wrote to memory of 2024 1232 540B.tmp 106 PID 2024 wrote to memory of 736 2024 5498.tmp 107 PID 2024 wrote to memory of 736 2024 5498.tmp 107 PID 2024 wrote to memory of 736 2024 5498.tmp 107 PID 736 wrote to memory of 3528 736 5515.tmp 108 PID 736 wrote to memory of 3528 736 5515.tmp 108 PID 736 wrote to memory of 3528 736 5515.tmp 108 PID 3528 wrote to memory of 1796 3528 55A2.tmp 109 PID 3528 wrote to memory of 1796 3528 55A2.tmp 109 PID 3528 wrote to memory of 1796 3528 55A2.tmp 109 PID 1796 wrote to memory of 3544 1796 562E.tmp 110 PID 1796 wrote to memory of 3544 1796 562E.tmp 110 PID 1796 wrote to memory of 3544 1796 562E.tmp 110 PID 3544 wrote to memory of 5012 3544 56AB.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_2eb9cdf5f26978ddc817ac00645cb87c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"23⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"24⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"25⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"26⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"27⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"28⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"29⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"30⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"31⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"32⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"33⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"34⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"35⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"36⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"37⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"38⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"39⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"40⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"41⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"42⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"43⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"44⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"45⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"46⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"47⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"48⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"49⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"50⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"51⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"52⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"53⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"54⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"55⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"56⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"57⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"58⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"59⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"60⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"61⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"62⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"63⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"64⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"65⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"66⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"67⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"68⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"69⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"71⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"72⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"73⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"74⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"75⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"77⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"78⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"79⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"80⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"81⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"82⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"83⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"84⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"85⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"86⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"87⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"88⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"89⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"90⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"92⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"93⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"94⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"95⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"97⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"98⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"99⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"100⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"101⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"102⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"103⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"104⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"105⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"106⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"107⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"108⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"110⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"111⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"112⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"113⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"114⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"115⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"116⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"117⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"118⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"119⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"120⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"121⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-