Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 14:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe
-
Size
486KB
-
MD5
013b6ab126f537f3bac3d8e0a48c779e
-
SHA1
064a9cfb6d2d95dfdbaad7920ee819d647237803
-
SHA256
78451ed27eb8d944f5da45dcc86ffb0ebd94d5f2f26d2d241085a85887a7fc66
-
SHA512
920ce87fc36eaa00447f5d13e7048c2f733fe65a4504cc5cf64cc4d1f6625fcfac535f1c916a37dada560cded40300d2352719bcd1ea0e8f113e9ef51b4707d6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD77EAjxl95ToF/TgE2jqaelTMZVYXzVpaze+Wm:/U5rCOTeiDPjxl7a/Sj6wZeJp5+2oNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2604 6B6C.tmp 4216 6C27.tmp 3572 6CD3.tmp 2672 6D7F.tmp 4600 6E0C.tmp 3304 6EC7.tmp 1328 6F54.tmp 1112 6FF0.tmp 4316 70AC.tmp 4008 7148.tmp 3960 71C5.tmp 5068 7280.tmp 2812 733C.tmp 396 73D8.tmp 3472 74D2.tmp 1348 757E.tmp 2464 7639.tmp 3940 7743.tmp 3600 77D0.tmp 4576 788B.tmp 4536 7947.tmp 3724 7A02.tmp 3796 7AAE.tmp 1804 7B5A.tmp 1716 7BE7.tmp 1320 7CC1.tmp 3204 7DFA.tmp 2092 7F61.tmp 5096 7FFD.tmp 3444 808A.tmp 64 8117.tmp 3336 8184.tmp 3740 824F.tmp 748 82AD.tmp 4280 830B.tmp 4424 8368.tmp 1844 83D6.tmp 1044 8443.tmp 4292 84EF.tmp 1276 855C.tmp 1916 85BA.tmp 2324 8628.tmp 4692 86C4.tmp 1876 8750.tmp 3612 880C.tmp 4668 88B8.tmp 3528 8935.tmp 3324 8993.tmp 1772 8A1F.tmp 3968 8AAC.tmp 1112 8B38.tmp 4316 8BB5.tmp 4008 8C32.tmp 964 8D6B.tmp 5068 8DE8.tmp 2232 8E65.tmp 3948 8EE2.tmp 1708 8F5F.tmp 1460 8FEC.tmp 4460 9049.tmp 3712 90D6.tmp 4996 9172.tmp 3940 920E.tmp 2536 9357.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2604 1892 2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe 88 PID 1892 wrote to memory of 2604 1892 2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe 88 PID 1892 wrote to memory of 2604 1892 2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe 88 PID 2604 wrote to memory of 4216 2604 6B6C.tmp 89 PID 2604 wrote to memory of 4216 2604 6B6C.tmp 89 PID 2604 wrote to memory of 4216 2604 6B6C.tmp 89 PID 4216 wrote to memory of 3572 4216 6C27.tmp 90 PID 4216 wrote to memory of 3572 4216 6C27.tmp 90 PID 4216 wrote to memory of 3572 4216 6C27.tmp 90 PID 3572 wrote to memory of 2672 3572 6CD3.tmp 91 PID 3572 wrote to memory of 2672 3572 6CD3.tmp 91 PID 3572 wrote to memory of 2672 3572 6CD3.tmp 91 PID 2672 wrote to memory of 4600 2672 6D7F.tmp 92 PID 2672 wrote to memory of 4600 2672 6D7F.tmp 92 PID 2672 wrote to memory of 4600 2672 6D7F.tmp 92 PID 4600 wrote to memory of 3304 4600 6E0C.tmp 93 PID 4600 wrote to memory of 3304 4600 6E0C.tmp 93 PID 4600 wrote to memory of 3304 4600 6E0C.tmp 93 PID 3304 wrote to memory of 1328 3304 6EC7.tmp 94 PID 3304 wrote to memory of 1328 3304 6EC7.tmp 94 PID 3304 wrote to memory of 1328 3304 6EC7.tmp 94 PID 1328 wrote to memory of 1112 1328 6F54.tmp 95 PID 1328 wrote to memory of 1112 1328 6F54.tmp 95 PID 1328 wrote to memory of 1112 1328 6F54.tmp 95 PID 1112 wrote to memory of 4316 1112 6FF0.tmp 96 PID 1112 wrote to memory of 4316 1112 6FF0.tmp 96 PID 1112 wrote to memory of 4316 1112 6FF0.tmp 96 PID 4316 wrote to memory of 4008 4316 70AC.tmp 97 PID 4316 wrote to memory of 4008 4316 70AC.tmp 97 PID 4316 wrote to memory of 4008 4316 70AC.tmp 97 PID 4008 wrote to memory of 3960 4008 7148.tmp 98 PID 4008 wrote to memory of 3960 4008 7148.tmp 98 PID 4008 wrote to memory of 3960 4008 7148.tmp 98 PID 3960 wrote to memory of 5068 3960 71C5.tmp 99 PID 3960 wrote to memory of 5068 3960 71C5.tmp 99 PID 3960 wrote to memory of 5068 3960 71C5.tmp 99 PID 5068 wrote to memory of 2812 5068 7280.tmp 100 PID 5068 wrote to memory of 2812 5068 7280.tmp 100 PID 5068 wrote to memory of 2812 5068 7280.tmp 100 PID 2812 wrote to memory of 396 2812 733C.tmp 101 PID 2812 wrote to memory of 396 2812 733C.tmp 101 PID 2812 wrote to memory of 396 2812 733C.tmp 101 PID 396 wrote to memory of 3472 396 73D8.tmp 102 PID 396 wrote to memory of 3472 396 73D8.tmp 102 PID 396 wrote to memory of 3472 396 73D8.tmp 102 PID 3472 wrote to memory of 1348 3472 74D2.tmp 103 PID 3472 wrote to memory of 1348 3472 74D2.tmp 103 PID 3472 wrote to memory of 1348 3472 74D2.tmp 103 PID 1348 wrote to memory of 2464 1348 757E.tmp 104 PID 1348 wrote to memory of 2464 1348 757E.tmp 104 PID 1348 wrote to memory of 2464 1348 757E.tmp 104 PID 2464 wrote to memory of 3940 2464 7639.tmp 105 PID 2464 wrote to memory of 3940 2464 7639.tmp 105 PID 2464 wrote to memory of 3940 2464 7639.tmp 105 PID 3940 wrote to memory of 3600 3940 7743.tmp 106 PID 3940 wrote to memory of 3600 3940 7743.tmp 106 PID 3940 wrote to memory of 3600 3940 7743.tmp 106 PID 3600 wrote to memory of 4576 3600 77D0.tmp 107 PID 3600 wrote to memory of 4576 3600 77D0.tmp 107 PID 3600 wrote to memory of 4576 3600 77D0.tmp 107 PID 4576 wrote to memory of 4536 4576 788B.tmp 108 PID 4576 wrote to memory of 4536 4576 788B.tmp 108 PID 4576 wrote to memory of 4536 4576 788B.tmp 108 PID 4536 wrote to memory of 3724 4536 7947.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_013b6ab126f537f3bac3d8e0a48c779e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"23⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"24⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"25⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"26⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"27⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"28⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"29⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"30⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"31⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"32⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"33⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"34⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"35⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"36⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"37⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"38⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"39⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"40⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"41⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"42⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"43⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"44⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"45⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"46⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"47⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"48⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"49⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"50⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"51⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"52⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"53⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"54⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"55⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"56⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"57⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"58⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"59⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"60⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"61⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"62⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"63⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"64⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"67⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"68⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"69⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"70⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"71⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"72⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"73⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"74⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"75⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"76⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"77⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"78⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"79⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"80⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"81⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"82⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"83⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"84⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"85⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"86⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"87⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"88⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"89⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"91⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"92⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"93⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"94⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"95⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"96⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"98⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"99⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"100⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"101⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"102⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"103⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"104⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"105⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"106⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"107⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"108⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"109⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"110⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"111⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"112⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"113⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"114⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"115⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"116⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"117⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"118⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"119⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"120⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"121⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"122⤵PID:3744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-