Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe
-
Size
488KB
-
MD5
7d4f0b312ff1f92d4850f51a87d0728a
-
SHA1
e953b77fc0fb02b602596a02597e1acc6d240fe0
-
SHA256
0682302207a9ff4ecaae4d2fc4a2b4e8e9a8e0bab6b6c695ecf01681764e7140
-
SHA512
9b3c25d9f897813a440611974c2659d90c78799c303ac8d294a65b716d1aa0b47fd9a06c7e3ee981122039b3d0f88d07ef78ac8cd3cd4862bf2c961d8c59fe57
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7D8XdOVauHBMb1tmTcPIf95ybvaFjDU35Y+gO:/U5rCOTeiDYXuBMbycw1Ubv/eLGNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2340 4631.tmp 4700 46BD.tmp 2984 473A.tmp 2776 47B7.tmp 3808 4815.tmp 4456 48A2.tmp 1480 48FF.tmp 3296 495D.tmp 548 49BB.tmp 3916 4A09.tmp 4980 4A76.tmp 2656 4AD4.tmp 3584 4B41.tmp 2168 4BAF.tmp 3912 4BFD.tmp 4256 4C5B.tmp 1668 4CB8.tmp 3252 4D16.tmp 532 4D84.tmp 456 4DE1.tmp 5104 4E3F.tmp 1224 4E9D.tmp 4412 4EFB.tmp 3692 4F49.tmp 4692 4FD5.tmp 5044 5033.tmp 4064 5081.tmp 2372 50CF.tmp 1904 511D.tmp 4860 519A.tmp 3272 51F8.tmp 5100 5256.tmp 1448 52B4.tmp 5084 5311.tmp 2128 5360.tmp 4060 53AE.tmp 3952 53FC.tmp 836 544A.tmp 3756 5498.tmp 4188 54E6.tmp 3588 5534.tmp 1828 5582.tmp 3048 55D1.tmp 1396 561F.tmp 4556 567C.tmp 4296 56CB.tmp 1348 5719.tmp 5072 5767.tmp 3436 57A5.tmp 4948 57F3.tmp 908 5842.tmp 4040 5890.tmp 4536 58CE.tmp 1620 591C.tmp 2724 596A.tmp 4532 59B9.tmp 4964 5A45.tmp 3208 5AA3.tmp 1676 5AF1.tmp 3076 5B3F.tmp 1584 5B9D.tmp 2820 5BEB.tmp 2932 5C39.tmp 4352 5C87.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2340 4832 2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe 83 PID 4832 wrote to memory of 2340 4832 2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe 83 PID 4832 wrote to memory of 2340 4832 2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe 83 PID 2340 wrote to memory of 4700 2340 4631.tmp 84 PID 2340 wrote to memory of 4700 2340 4631.tmp 84 PID 2340 wrote to memory of 4700 2340 4631.tmp 84 PID 4700 wrote to memory of 2984 4700 46BD.tmp 85 PID 4700 wrote to memory of 2984 4700 46BD.tmp 85 PID 4700 wrote to memory of 2984 4700 46BD.tmp 85 PID 2984 wrote to memory of 2776 2984 473A.tmp 86 PID 2984 wrote to memory of 2776 2984 473A.tmp 86 PID 2984 wrote to memory of 2776 2984 473A.tmp 86 PID 2776 wrote to memory of 3808 2776 47B7.tmp 87 PID 2776 wrote to memory of 3808 2776 47B7.tmp 87 PID 2776 wrote to memory of 3808 2776 47B7.tmp 87 PID 3808 wrote to memory of 4456 3808 4815.tmp 88 PID 3808 wrote to memory of 4456 3808 4815.tmp 88 PID 3808 wrote to memory of 4456 3808 4815.tmp 88 PID 4456 wrote to memory of 1480 4456 48A2.tmp 89 PID 4456 wrote to memory of 1480 4456 48A2.tmp 89 PID 4456 wrote to memory of 1480 4456 48A2.tmp 89 PID 1480 wrote to memory of 3296 1480 48FF.tmp 90 PID 1480 wrote to memory of 3296 1480 48FF.tmp 90 PID 1480 wrote to memory of 3296 1480 48FF.tmp 90 PID 3296 wrote to memory of 548 3296 495D.tmp 91 PID 3296 wrote to memory of 548 3296 495D.tmp 91 PID 3296 wrote to memory of 548 3296 495D.tmp 91 PID 548 wrote to memory of 3916 548 49BB.tmp 92 PID 548 wrote to memory of 3916 548 49BB.tmp 92 PID 548 wrote to memory of 3916 548 49BB.tmp 92 PID 3916 wrote to memory of 4980 3916 4A09.tmp 93 PID 3916 wrote to memory of 4980 3916 4A09.tmp 93 PID 3916 wrote to memory of 4980 3916 4A09.tmp 93 PID 4980 wrote to memory of 2656 4980 4A76.tmp 94 PID 4980 wrote to memory of 2656 4980 4A76.tmp 94 PID 4980 wrote to memory of 2656 4980 4A76.tmp 94 PID 2656 wrote to memory of 3584 2656 4AD4.tmp 95 PID 2656 wrote to memory of 3584 2656 4AD4.tmp 95 PID 2656 wrote to memory of 3584 2656 4AD4.tmp 95 PID 3584 wrote to memory of 2168 3584 4B41.tmp 96 PID 3584 wrote to memory of 2168 3584 4B41.tmp 96 PID 3584 wrote to memory of 2168 3584 4B41.tmp 96 PID 2168 wrote to memory of 3912 2168 4BAF.tmp 97 PID 2168 wrote to memory of 3912 2168 4BAF.tmp 97 PID 2168 wrote to memory of 3912 2168 4BAF.tmp 97 PID 3912 wrote to memory of 4256 3912 4BFD.tmp 98 PID 3912 wrote to memory of 4256 3912 4BFD.tmp 98 PID 3912 wrote to memory of 4256 3912 4BFD.tmp 98 PID 4256 wrote to memory of 1668 4256 4C5B.tmp 99 PID 4256 wrote to memory of 1668 4256 4C5B.tmp 99 PID 4256 wrote to memory of 1668 4256 4C5B.tmp 99 PID 1668 wrote to memory of 3252 1668 4CB8.tmp 100 PID 1668 wrote to memory of 3252 1668 4CB8.tmp 100 PID 1668 wrote to memory of 3252 1668 4CB8.tmp 100 PID 3252 wrote to memory of 532 3252 4D16.tmp 101 PID 3252 wrote to memory of 532 3252 4D16.tmp 101 PID 3252 wrote to memory of 532 3252 4D16.tmp 101 PID 532 wrote to memory of 456 532 4D84.tmp 102 PID 532 wrote to memory of 456 532 4D84.tmp 102 PID 532 wrote to memory of 456 532 4D84.tmp 102 PID 456 wrote to memory of 5104 456 4DE1.tmp 103 PID 456 wrote to memory of 5104 456 4DE1.tmp 103 PID 456 wrote to memory of 5104 456 4DE1.tmp 103 PID 5104 wrote to memory of 1224 5104 4E3F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_7d4f0b312ff1f92d4850f51a87d0728a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"23⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"24⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"25⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"26⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"27⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"28⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"29⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"30⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"31⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"32⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"33⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"34⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"35⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"36⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"37⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"38⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"39⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"40⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"41⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"42⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"43⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"44⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"45⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"46⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"47⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"48⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"49⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"50⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"51⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"52⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"53⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"54⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"55⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"56⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"57⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"58⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"59⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"60⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"61⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"62⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"63⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"64⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"65⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"67⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"68⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"69⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"70⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"71⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"72⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"73⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"74⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"75⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"76⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"78⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"79⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"80⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"81⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"82⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"83⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"84⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"85⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"86⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"87⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"88⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"89⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"90⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"91⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"92⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"93⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"94⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"95⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"96⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"97⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"98⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"99⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"100⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"101⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"102⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"103⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"104⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"105⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"106⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"107⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"108⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"109⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"110⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"111⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"112⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"113⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"114⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"115⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"116⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"117⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"118⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"119⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"121⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-