Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 11:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe
-
Size
486KB
-
MD5
dd36cc28695ded5a2d018cfc4b5b0118
-
SHA1
774d79738a3be1d077aca6fb8c9349f4fee9ec9b
-
SHA256
921798819855b2ae7e1d424a9202d8022c6eb78d373518c280d7694845a435bb
-
SHA512
84c99c7360a69c850b4368e1f52b0f13fdfb3c9c8515db17a4eddad5c756d4b662fce166f0363f228e6625bd54fe449d1f2a89409406f8feaad158d245f0a7ee
-
SSDEEP
12288:UU5rCOTeiDxSLS1hHm9sD0xQKu9UX55d2BNZ:UUQOJDeKdEr3u9UXMBN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4460 5C87.tmp 2248 5D14.tmp 4588 5DDF.tmp 2720 5EAA.tmp 3636 5F27.tmp 3496 5FC3.tmp 1812 6031.tmp 1196 60BD.tmp 4820 615A.tmp 1192 61E6.tmp 1856 6283.tmp 4640 631F.tmp 3212 63CB.tmp 1860 6477.tmp 1180 64E4.tmp 2840 6590.tmp 380 6B7B.tmp 2908 6C08.tmp 536 6C95.tmp 4184 6D31.tmp 968 6DAE.tmp 4972 6E1B.tmp 3816 6F06.tmp 2204 6FB2.tmp 2860 704E.tmp 4476 70DA.tmp 2120 71A6.tmp 4920 7232.tmp 220 72CE.tmp 236 735B.tmp 3484 73F7.tmp 924 74B3.tmp 4036 753F.tmp 1052 75AD.tmp 2216 761A.tmp 1456 76A7.tmp 2720 7714.tmp 3444 7782.tmp 2556 77EF.tmp 4232 784D.tmp 4284 78AA.tmp 3204 7918.tmp 1856 7985.tmp 1532 7A02.tmp 3092 7A70.tmp 2040 7AED.tmp 1860 7C35.tmp 2672 7CA2.tmp 4544 7D2F.tmp 4364 7DBB.tmp 1384 7E48.tmp 3904 7EB5.tmp 3304 7F52.tmp 1656 7FEE.tmp 4660 806B.tmp 2596 80E8.tmp 2844 8155.tmp 4804 81D2.tmp 3816 8230.tmp 4852 82BD.tmp 5028 833A.tmp 2120 83A7.tmp 3652 8434.tmp 3756 84B1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3488 wrote to memory of 4460 3488 2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe 90 PID 3488 wrote to memory of 4460 3488 2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe 90 PID 3488 wrote to memory of 4460 3488 2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe 90 PID 4460 wrote to memory of 2248 4460 5C87.tmp 91 PID 4460 wrote to memory of 2248 4460 5C87.tmp 91 PID 4460 wrote to memory of 2248 4460 5C87.tmp 91 PID 2248 wrote to memory of 4588 2248 5D14.tmp 93 PID 2248 wrote to memory of 4588 2248 5D14.tmp 93 PID 2248 wrote to memory of 4588 2248 5D14.tmp 93 PID 4588 wrote to memory of 2720 4588 5DDF.tmp 94 PID 4588 wrote to memory of 2720 4588 5DDF.tmp 94 PID 4588 wrote to memory of 2720 4588 5DDF.tmp 94 PID 2720 wrote to memory of 3636 2720 5EAA.tmp 95 PID 2720 wrote to memory of 3636 2720 5EAA.tmp 95 PID 2720 wrote to memory of 3636 2720 5EAA.tmp 95 PID 3636 wrote to memory of 3496 3636 5F27.tmp 96 PID 3636 wrote to memory of 3496 3636 5F27.tmp 96 PID 3636 wrote to memory of 3496 3636 5F27.tmp 96 PID 3496 wrote to memory of 1812 3496 5FC3.tmp 97 PID 3496 wrote to memory of 1812 3496 5FC3.tmp 97 PID 3496 wrote to memory of 1812 3496 5FC3.tmp 97 PID 1812 wrote to memory of 1196 1812 6031.tmp 98 PID 1812 wrote to memory of 1196 1812 6031.tmp 98 PID 1812 wrote to memory of 1196 1812 6031.tmp 98 PID 1196 wrote to memory of 4820 1196 60BD.tmp 99 PID 1196 wrote to memory of 4820 1196 60BD.tmp 99 PID 1196 wrote to memory of 4820 1196 60BD.tmp 99 PID 4820 wrote to memory of 1192 4820 615A.tmp 100 PID 4820 wrote to memory of 1192 4820 615A.tmp 100 PID 4820 wrote to memory of 1192 4820 615A.tmp 100 PID 1192 wrote to memory of 1856 1192 61E6.tmp 101 PID 1192 wrote to memory of 1856 1192 61E6.tmp 101 PID 1192 wrote to memory of 1856 1192 61E6.tmp 101 PID 1856 wrote to memory of 4640 1856 6283.tmp 102 PID 1856 wrote to memory of 4640 1856 6283.tmp 102 PID 1856 wrote to memory of 4640 1856 6283.tmp 102 PID 4640 wrote to memory of 3212 4640 631F.tmp 103 PID 4640 wrote to memory of 3212 4640 631F.tmp 103 PID 4640 wrote to memory of 3212 4640 631F.tmp 103 PID 3212 wrote to memory of 1860 3212 63CB.tmp 104 PID 3212 wrote to memory of 1860 3212 63CB.tmp 104 PID 3212 wrote to memory of 1860 3212 63CB.tmp 104 PID 1860 wrote to memory of 1180 1860 6477.tmp 105 PID 1860 wrote to memory of 1180 1860 6477.tmp 105 PID 1860 wrote to memory of 1180 1860 6477.tmp 105 PID 1180 wrote to memory of 2840 1180 64E4.tmp 106 PID 1180 wrote to memory of 2840 1180 64E4.tmp 106 PID 1180 wrote to memory of 2840 1180 64E4.tmp 106 PID 2840 wrote to memory of 380 2840 6590.tmp 107 PID 2840 wrote to memory of 380 2840 6590.tmp 107 PID 2840 wrote to memory of 380 2840 6590.tmp 107 PID 380 wrote to memory of 2908 380 6B7B.tmp 108 PID 380 wrote to memory of 2908 380 6B7B.tmp 108 PID 380 wrote to memory of 2908 380 6B7B.tmp 108 PID 2908 wrote to memory of 536 2908 6C08.tmp 109 PID 2908 wrote to memory of 536 2908 6C08.tmp 109 PID 2908 wrote to memory of 536 2908 6C08.tmp 109 PID 536 wrote to memory of 4184 536 6C95.tmp 110 PID 536 wrote to memory of 4184 536 6C95.tmp 110 PID 536 wrote to memory of 4184 536 6C95.tmp 110 PID 4184 wrote to memory of 968 4184 6D31.tmp 111 PID 4184 wrote to memory of 968 4184 6D31.tmp 111 PID 4184 wrote to memory of 968 4184 6D31.tmp 111 PID 968 wrote to memory of 4972 968 6DAE.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_dd36cc28695ded5a2d018cfc4b5b0118_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"23⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"24⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"25⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"26⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"27⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"28⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"29⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"30⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"31⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"32⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"33⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"34⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"35⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"36⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"37⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"38⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"39⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"40⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"41⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"42⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"43⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"44⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"45⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"46⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"47⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"48⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"49⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"50⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"51⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"52⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"53⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"54⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"55⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"56⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"57⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"58⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"59⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"60⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"61⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"62⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"63⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"64⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"65⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"66⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"67⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"68⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"69⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"70⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"71⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"72⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"73⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"74⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"75⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"76⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"77⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"78⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"79⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"80⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"81⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"82⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"83⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"84⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"85⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"86⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"87⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"88⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"89⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"90⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"91⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"92⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"93⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"94⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"95⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"96⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"97⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"98⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"99⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"100⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"101⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"102⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"103⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"104⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"105⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"106⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"107⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"108⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"109⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"110⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"112⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"113⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"114⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"115⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"116⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"118⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"119⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"120⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"121⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"122⤵PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-