Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe
-
Size
520KB
-
MD5
f182738797f19332e709b4e59d2ca6c8
-
SHA1
87a4ea7341a4db31b7318e04644f84773e2da5e4
-
SHA256
3ed057918989e191e9c9df22bc3579c37080e017f1e3d43cab24c04ae5854542
-
SHA512
67780f264fb7e871db5139f1669c144fbea35dae032c5b0942f87c526b198c959d3107c96b754fc1fd2fe9c5185d40e844291de0c23cd15372f976e3b6a95b65
-
SSDEEP
12288:gj8fuxR21t5i8fWIPb9K4i+OVelq7xsVAZjBtNZ:gj8fuK1GYRTV1OVelq7uWN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 60 41DB.tmp 3116 4268.tmp 2996 42E5.tmp 1064 4352.tmp 2808 43B0.tmp 2356 443D.tmp 2860 44AA.tmp 4924 44F8.tmp 1424 4565.tmp 472 45D3.tmp 2912 4621.tmp 2416 467F.tmp 4436 46FC.tmp 3224 4769.tmp 644 47C7.tmp 3156 4825.tmp 2188 4892.tmp 8 490F.tmp 1560 497C.tmp 3088 49F9.tmp 2524 4A47.tmp 4160 4AA5.tmp 4424 4B22.tmp 3148 4B80.tmp 3508 4BED.tmp 4516 4C3B.tmp 3516 4C99.tmp 2968 4CF7.tmp 3728 4D55.tmp 1640 4DA3.tmp 1660 4E2F.tmp 3044 4E8D.tmp 4300 4EFB.tmp 2092 4F49.tmp 236 4FB6.tmp 4648 5004.tmp 1952 5062.tmp 1824 50CF.tmp 4228 512D.tmp 1044 518B.tmp 2860 51E9.tmp 4836 5246.tmp 1572 52A4.tmp 2316 5302.tmp 2896 5360.tmp 1508 53BD.tmp 2912 540B.tmp 3416 545A.tmp 4436 54A8.tmp 3232 54F6.tmp 4708 5554.tmp 2340 55A2.tmp 4324 55F0.tmp 1488 563E.tmp 1648 568C.tmp 4380 56EA.tmp 2908 5738.tmp 3204 5796.tmp 4352 57E4.tmp 4808 5832.tmp 2916 5880.tmp 3816 58CE.tmp 3744 591C.tmp 4516 596A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 60 3512 2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe 84 PID 3512 wrote to memory of 60 3512 2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe 84 PID 3512 wrote to memory of 60 3512 2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe 84 PID 60 wrote to memory of 3116 60 41DB.tmp 85 PID 60 wrote to memory of 3116 60 41DB.tmp 85 PID 60 wrote to memory of 3116 60 41DB.tmp 85 PID 3116 wrote to memory of 2996 3116 4268.tmp 86 PID 3116 wrote to memory of 2996 3116 4268.tmp 86 PID 3116 wrote to memory of 2996 3116 4268.tmp 86 PID 2996 wrote to memory of 1064 2996 42E5.tmp 87 PID 2996 wrote to memory of 1064 2996 42E5.tmp 87 PID 2996 wrote to memory of 1064 2996 42E5.tmp 87 PID 1064 wrote to memory of 2808 1064 4352.tmp 89 PID 1064 wrote to memory of 2808 1064 4352.tmp 89 PID 1064 wrote to memory of 2808 1064 4352.tmp 89 PID 2808 wrote to memory of 2356 2808 43B0.tmp 90 PID 2808 wrote to memory of 2356 2808 43B0.tmp 90 PID 2808 wrote to memory of 2356 2808 43B0.tmp 90 PID 2356 wrote to memory of 2860 2356 443D.tmp 92 PID 2356 wrote to memory of 2860 2356 443D.tmp 92 PID 2356 wrote to memory of 2860 2356 443D.tmp 92 PID 2860 wrote to memory of 4924 2860 44AA.tmp 93 PID 2860 wrote to memory of 4924 2860 44AA.tmp 93 PID 2860 wrote to memory of 4924 2860 44AA.tmp 93 PID 4924 wrote to memory of 1424 4924 44F8.tmp 94 PID 4924 wrote to memory of 1424 4924 44F8.tmp 94 PID 4924 wrote to memory of 1424 4924 44F8.tmp 94 PID 1424 wrote to memory of 472 1424 4565.tmp 95 PID 1424 wrote to memory of 472 1424 4565.tmp 95 PID 1424 wrote to memory of 472 1424 4565.tmp 95 PID 472 wrote to memory of 2912 472 45D3.tmp 96 PID 472 wrote to memory of 2912 472 45D3.tmp 96 PID 472 wrote to memory of 2912 472 45D3.tmp 96 PID 2912 wrote to memory of 2416 2912 4621.tmp 97 PID 2912 wrote to memory of 2416 2912 4621.tmp 97 PID 2912 wrote to memory of 2416 2912 4621.tmp 97 PID 2416 wrote to memory of 4436 2416 467F.tmp 98 PID 2416 wrote to memory of 4436 2416 467F.tmp 98 PID 2416 wrote to memory of 4436 2416 467F.tmp 98 PID 4436 wrote to memory of 3224 4436 46FC.tmp 99 PID 4436 wrote to memory of 3224 4436 46FC.tmp 99 PID 4436 wrote to memory of 3224 4436 46FC.tmp 99 PID 3224 wrote to memory of 644 3224 4769.tmp 100 PID 3224 wrote to memory of 644 3224 4769.tmp 100 PID 3224 wrote to memory of 644 3224 4769.tmp 100 PID 644 wrote to memory of 3156 644 47C7.tmp 101 PID 644 wrote to memory of 3156 644 47C7.tmp 101 PID 644 wrote to memory of 3156 644 47C7.tmp 101 PID 3156 wrote to memory of 2188 3156 4825.tmp 102 PID 3156 wrote to memory of 2188 3156 4825.tmp 102 PID 3156 wrote to memory of 2188 3156 4825.tmp 102 PID 2188 wrote to memory of 8 2188 4892.tmp 103 PID 2188 wrote to memory of 8 2188 4892.tmp 103 PID 2188 wrote to memory of 8 2188 4892.tmp 103 PID 8 wrote to memory of 1560 8 490F.tmp 104 PID 8 wrote to memory of 1560 8 490F.tmp 104 PID 8 wrote to memory of 1560 8 490F.tmp 104 PID 1560 wrote to memory of 3088 1560 497C.tmp 105 PID 1560 wrote to memory of 3088 1560 497C.tmp 105 PID 1560 wrote to memory of 3088 1560 497C.tmp 105 PID 3088 wrote to memory of 2524 3088 49F9.tmp 106 PID 3088 wrote to memory of 2524 3088 49F9.tmp 106 PID 3088 wrote to memory of 2524 3088 49F9.tmp 106 PID 2524 wrote to memory of 4160 2524 4A47.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_f182738797f19332e709b4e59d2ca6c8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"23⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"24⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"25⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"26⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"27⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"28⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"29⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"30⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"31⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"32⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"33⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"34⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"35⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"36⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"37⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"38⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"39⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"40⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"41⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"42⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"43⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"44⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"45⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"46⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"47⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"48⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"49⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"50⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"51⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"52⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"53⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"54⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"55⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"56⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"57⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"58⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"59⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"60⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"61⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"62⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"63⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"64⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"65⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"66⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"67⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"68⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"69⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"70⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"71⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"72⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"73⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"74⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"75⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"76⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"77⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"79⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"80⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"81⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"82⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"83⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"84⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"85⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"86⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"87⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"88⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"89⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"90⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"91⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"92⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"93⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"94⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"95⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"96⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"97⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"98⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"99⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"100⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"102⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"103⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"104⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"105⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"106⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"107⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"108⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"110⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"111⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"112⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"113⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"114⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"115⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"116⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"117⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"118⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"119⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"121⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"122⤵PID:4940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-