Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe
-
Size
486KB
-
MD5
6eae12c4a0b4c705f336134ae27a67e8
-
SHA1
3d3fe9ad5ab4161acdb5782daaafc8efd9356694
-
SHA256
85acc06a4f3b0ac6df1359526e59dd2c634f4da180c03165e81c0403190bf3bc
-
SHA512
5e7c2ef915f598979d19834a06e20ccaa7c9d21df7c616d116934e56cbac626c205c8dcd38f273f6de84c35b3d9ef698eee1a89f70a5fef7531a771525df198e
-
SSDEEP
12288:/U5rCOTeiDXE6Hj0O5198MvJ6ZyeDL4NZ:/UQOJDXE6P19DJ6RDMN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1880 5832.tmp 2804 58DE.tmp 1940 598A.tmp 4416 5A64.tmp 1676 5AE1.tmp 2024 5B8D.tmp 4880 5C58.tmp 1868 5CF5.tmp 1620 5DA1.tmp 5084 5E1E.tmp 1468 5EC9.tmp 4872 5F66.tmp 5088 6012.tmp 2404 60CD.tmp 4412 61B7.tmp 2724 633E.tmp 3972 6428.tmp 1884 65CE.tmp 3348 663C.tmp 2720 66C8.tmp 2244 67C2.tmp 5040 684F.tmp 2204 68FB.tmp 5004 6997.tmp 3608 6A33.tmp 1320 6AA1.tmp 4468 6B6C.tmp 4532 6C08.tmp 3428 6C95.tmp 1540 6D41.tmp 4680 6DEC.tmp 428 6E89.tmp 408 6F25.tmp 900 6FA2.tmp 2168 7000.tmp 2892 706D.tmp 3372 70CB.tmp 2568 7138.tmp 1620 71D4.tmp 3636 7271.tmp 488 731D.tmp 4848 73B9.tmp 1976 7465.tmp 2388 74E2.tmp 4964 756E.tmp 2360 75FB.tmp 3728 7697.tmp 716 7724.tmp 4900 77B0.tmp 3740 782D.tmp 2736 78E9.tmp 1828 7985.tmp 2704 7A02.tmp 948 7AAE.tmp 1888 7B4A.tmp 3280 7BB8.tmp 4160 7C25.tmp 3380 7CA2.tmp 4492 7D0F.tmp 2348 7D9C.tmp 2240 7E19.tmp 4604 7EA6.tmp 2620 7F42.tmp 3668 7FAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 1880 3416 2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe 87 PID 3416 wrote to memory of 1880 3416 2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe 87 PID 3416 wrote to memory of 1880 3416 2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe 87 PID 1880 wrote to memory of 2804 1880 5832.tmp 88 PID 1880 wrote to memory of 2804 1880 5832.tmp 88 PID 1880 wrote to memory of 2804 1880 5832.tmp 88 PID 2804 wrote to memory of 1940 2804 58DE.tmp 90 PID 2804 wrote to memory of 1940 2804 58DE.tmp 90 PID 2804 wrote to memory of 1940 2804 58DE.tmp 90 PID 1940 wrote to memory of 4416 1940 598A.tmp 92 PID 1940 wrote to memory of 4416 1940 598A.tmp 92 PID 1940 wrote to memory of 4416 1940 598A.tmp 92 PID 4416 wrote to memory of 1676 4416 5A64.tmp 94 PID 4416 wrote to memory of 1676 4416 5A64.tmp 94 PID 4416 wrote to memory of 1676 4416 5A64.tmp 94 PID 1676 wrote to memory of 2024 1676 5AE1.tmp 95 PID 1676 wrote to memory of 2024 1676 5AE1.tmp 95 PID 1676 wrote to memory of 2024 1676 5AE1.tmp 95 PID 2024 wrote to memory of 4880 2024 5B8D.tmp 96 PID 2024 wrote to memory of 4880 2024 5B8D.tmp 96 PID 2024 wrote to memory of 4880 2024 5B8D.tmp 96 PID 4880 wrote to memory of 1868 4880 5C58.tmp 97 PID 4880 wrote to memory of 1868 4880 5C58.tmp 97 PID 4880 wrote to memory of 1868 4880 5C58.tmp 97 PID 1868 wrote to memory of 1620 1868 5CF5.tmp 98 PID 1868 wrote to memory of 1620 1868 5CF5.tmp 98 PID 1868 wrote to memory of 1620 1868 5CF5.tmp 98 PID 1620 wrote to memory of 5084 1620 5DA1.tmp 99 PID 1620 wrote to memory of 5084 1620 5DA1.tmp 99 PID 1620 wrote to memory of 5084 1620 5DA1.tmp 99 PID 5084 wrote to memory of 1468 5084 5E1E.tmp 100 PID 5084 wrote to memory of 1468 5084 5E1E.tmp 100 PID 5084 wrote to memory of 1468 5084 5E1E.tmp 100 PID 1468 wrote to memory of 4872 1468 5EC9.tmp 101 PID 1468 wrote to memory of 4872 1468 5EC9.tmp 101 PID 1468 wrote to memory of 4872 1468 5EC9.tmp 101 PID 4872 wrote to memory of 5088 4872 5F66.tmp 102 PID 4872 wrote to memory of 5088 4872 5F66.tmp 102 PID 4872 wrote to memory of 5088 4872 5F66.tmp 102 PID 5088 wrote to memory of 2404 5088 6012.tmp 103 PID 5088 wrote to memory of 2404 5088 6012.tmp 103 PID 5088 wrote to memory of 2404 5088 6012.tmp 103 PID 2404 wrote to memory of 4412 2404 60CD.tmp 105 PID 2404 wrote to memory of 4412 2404 60CD.tmp 105 PID 2404 wrote to memory of 4412 2404 60CD.tmp 105 PID 4412 wrote to memory of 2724 4412 61B7.tmp 106 PID 4412 wrote to memory of 2724 4412 61B7.tmp 106 PID 4412 wrote to memory of 2724 4412 61B7.tmp 106 PID 2724 wrote to memory of 3972 2724 633E.tmp 108 PID 2724 wrote to memory of 3972 2724 633E.tmp 108 PID 2724 wrote to memory of 3972 2724 633E.tmp 108 PID 3972 wrote to memory of 1884 3972 6428.tmp 110 PID 3972 wrote to memory of 1884 3972 6428.tmp 110 PID 3972 wrote to memory of 1884 3972 6428.tmp 110 PID 1884 wrote to memory of 3348 1884 65CE.tmp 111 PID 1884 wrote to memory of 3348 1884 65CE.tmp 111 PID 1884 wrote to memory of 3348 1884 65CE.tmp 111 PID 3348 wrote to memory of 2720 3348 663C.tmp 113 PID 3348 wrote to memory of 2720 3348 663C.tmp 113 PID 3348 wrote to memory of 2720 3348 663C.tmp 113 PID 2720 wrote to memory of 2244 2720 66C8.tmp 114 PID 2720 wrote to memory of 2244 2720 66C8.tmp 114 PID 2720 wrote to memory of 2244 2720 66C8.tmp 114 PID 2244 wrote to memory of 5040 2244 67C2.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_6eae12c4a0b4c705f336134ae27a67e8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"23⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"24⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"25⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"26⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"27⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"28⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"29⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"30⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"31⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"32⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"33⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"34⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"35⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"36⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"37⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"38⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"39⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"40⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"41⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"42⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"43⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"44⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"45⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"46⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"47⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"48⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"49⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"50⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"51⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"52⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"53⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"54⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"55⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"56⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"57⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"58⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"59⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"60⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"61⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"62⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"63⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"64⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"65⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"66⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"67⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"68⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"69⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"70⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"71⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"72⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"73⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"74⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"76⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"77⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"78⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"79⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"80⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"81⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"82⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"83⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"84⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"85⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"86⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"87⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"88⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"89⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"90⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"91⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"92⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"93⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"94⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"96⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"97⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"98⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"99⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"101⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"102⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"103⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"104⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"105⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"106⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"107⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"108⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"109⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"110⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"111⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"112⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"113⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"114⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"115⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"116⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"117⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"118⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"119⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"120⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"121⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-