Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe
-
Size
487KB
-
MD5
18877671c9f38c0e0a6a31742d3df4f9
-
SHA1
8d9a19826e28e6fcc7b8caa144ce10790b7a8ed3
-
SHA256
58125fa9cb4639cb761e3cca9f75966ebca6587e71561717845595eb9ab32b99
-
SHA512
fc4cea0b072d260126d27be131b3fc613bc8f20fac97c94ac945bf39d4c253e9725ada1b043919df8520405366cd96c014bc2f08e873801368348104ae9f049b
-
SSDEEP
12288:HU5rCOTeiJGnkqXbKCHZ4uVo0U7WImbD6aNZ:HUQOJJ8brKy1xPbWaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2728 7501.tmp 2012 75DC.tmp 2292 76A7.tmp 4344 7753.tmp 5100 783D.tmp 876 7908.tmp 4912 79B4.tmp 2344 7A60.tmp 5036 7B0C.tmp 5020 7BA8.tmp 4548 7C54.tmp 4916 7D0F.tmp 3816 7DBB.tmp 2188 7E58.tmp 1640 7FA0.tmp 2632 806B.tmp 2104 8136.tmp 5112 8211.tmp 4604 82CC.tmp 4272 8359.tmp 4932 8443.tmp 440 84D0.tmp 4844 857C.tmp 4660 8628.tmp 1660 86B4.tmp 1684 879F.tmp 4584 8879.tmp 2392 8973.tmp 3952 8A5E.tmp 3148 8B67.tmp 3532 8C52.tmp 2996 8D4C.tmp 2252 8E07.tmp 2532 8E84.tmp 4684 8EF2.tmp 2272 8F8E.tmp 4308 903A.tmp 4460 90D6.tmp 2136 9143.tmp 4080 91FF.tmp 3280 928B.tmp 4540 9318.tmp 2432 9385.tmp 2456 9422.tmp 1520 951C.tmp 3236 9589.tmp 2292 9635.tmp 5052 96C2.tmp 4732 974E.tmp 2412 97CB.tmp 876 9848.tmp 4332 98E4.tmp 1432 9952.tmp 400 99EE.tmp 4268 9A6B.tmp 4492 9B17.tmp 3512 9BB3.tmp 1868 9C21.tmp 4916 9C9E.tmp 416 9D2A.tmp 828 9DB7.tmp 2672 9E43.tmp 2468 9EC0.tmp 4656 9F4D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 2728 4064 2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe 84 PID 4064 wrote to memory of 2728 4064 2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe 84 PID 4064 wrote to memory of 2728 4064 2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe 84 PID 2728 wrote to memory of 2012 2728 7501.tmp 86 PID 2728 wrote to memory of 2012 2728 7501.tmp 86 PID 2728 wrote to memory of 2012 2728 7501.tmp 86 PID 2012 wrote to memory of 2292 2012 75DC.tmp 87 PID 2012 wrote to memory of 2292 2012 75DC.tmp 87 PID 2012 wrote to memory of 2292 2012 75DC.tmp 87 PID 2292 wrote to memory of 4344 2292 76A7.tmp 88 PID 2292 wrote to memory of 4344 2292 76A7.tmp 88 PID 2292 wrote to memory of 4344 2292 76A7.tmp 88 PID 4344 wrote to memory of 5100 4344 7753.tmp 89 PID 4344 wrote to memory of 5100 4344 7753.tmp 89 PID 4344 wrote to memory of 5100 4344 7753.tmp 89 PID 5100 wrote to memory of 876 5100 783D.tmp 91 PID 5100 wrote to memory of 876 5100 783D.tmp 91 PID 5100 wrote to memory of 876 5100 783D.tmp 91 PID 876 wrote to memory of 4912 876 7908.tmp 92 PID 876 wrote to memory of 4912 876 7908.tmp 92 PID 876 wrote to memory of 4912 876 7908.tmp 92 PID 4912 wrote to memory of 2344 4912 79B4.tmp 93 PID 4912 wrote to memory of 2344 4912 79B4.tmp 93 PID 4912 wrote to memory of 2344 4912 79B4.tmp 93 PID 2344 wrote to memory of 5036 2344 7A60.tmp 94 PID 2344 wrote to memory of 5036 2344 7A60.tmp 94 PID 2344 wrote to memory of 5036 2344 7A60.tmp 94 PID 5036 wrote to memory of 5020 5036 7B0C.tmp 95 PID 5036 wrote to memory of 5020 5036 7B0C.tmp 95 PID 5036 wrote to memory of 5020 5036 7B0C.tmp 95 PID 5020 wrote to memory of 4548 5020 7BA8.tmp 96 PID 5020 wrote to memory of 4548 5020 7BA8.tmp 96 PID 5020 wrote to memory of 4548 5020 7BA8.tmp 96 PID 4548 wrote to memory of 4916 4548 7C54.tmp 97 PID 4548 wrote to memory of 4916 4548 7C54.tmp 97 PID 4548 wrote to memory of 4916 4548 7C54.tmp 97 PID 4916 wrote to memory of 3816 4916 7D0F.tmp 98 PID 4916 wrote to memory of 3816 4916 7D0F.tmp 98 PID 4916 wrote to memory of 3816 4916 7D0F.tmp 98 PID 3816 wrote to memory of 2188 3816 7DBB.tmp 99 PID 3816 wrote to memory of 2188 3816 7DBB.tmp 99 PID 3816 wrote to memory of 2188 3816 7DBB.tmp 99 PID 2188 wrote to memory of 1640 2188 7E58.tmp 100 PID 2188 wrote to memory of 1640 2188 7E58.tmp 100 PID 2188 wrote to memory of 1640 2188 7E58.tmp 100 PID 1640 wrote to memory of 2632 1640 7FA0.tmp 102 PID 1640 wrote to memory of 2632 1640 7FA0.tmp 102 PID 1640 wrote to memory of 2632 1640 7FA0.tmp 102 PID 2632 wrote to memory of 2104 2632 806B.tmp 103 PID 2632 wrote to memory of 2104 2632 806B.tmp 103 PID 2632 wrote to memory of 2104 2632 806B.tmp 103 PID 2104 wrote to memory of 5112 2104 8136.tmp 104 PID 2104 wrote to memory of 5112 2104 8136.tmp 104 PID 2104 wrote to memory of 5112 2104 8136.tmp 104 PID 5112 wrote to memory of 4604 5112 8211.tmp 105 PID 5112 wrote to memory of 4604 5112 8211.tmp 105 PID 5112 wrote to memory of 4604 5112 8211.tmp 105 PID 4604 wrote to memory of 4272 4604 82CC.tmp 107 PID 4604 wrote to memory of 4272 4604 82CC.tmp 107 PID 4604 wrote to memory of 4272 4604 82CC.tmp 107 PID 4272 wrote to memory of 4932 4272 8359.tmp 108 PID 4272 wrote to memory of 4932 4272 8359.tmp 108 PID 4272 wrote to memory of 4932 4272 8359.tmp 108 PID 4932 wrote to memory of 440 4932 8443.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_18877671c9f38c0e0a6a31742d3df4f9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"23⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"24⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"25⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"26⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"27⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"28⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"29⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"30⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"31⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"32⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"33⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"34⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"35⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"36⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"37⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"38⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"39⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"40⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"41⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"42⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"43⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"44⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"45⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"46⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"47⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"48⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"49⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"50⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"51⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"52⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"53⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"54⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"55⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"56⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"57⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"58⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"59⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"60⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"61⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"62⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"63⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"64⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"65⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"66⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"67⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"68⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"69⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"70⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"71⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"72⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"74⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"75⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"76⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"77⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"78⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"79⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"80⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"81⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"82⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"83⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"84⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"85⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"86⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"87⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"88⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"89⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"90⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"92⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"93⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"94⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"95⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"96⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"97⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"98⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"99⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"100⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"101⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"102⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"103⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"104⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"105⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"106⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"107⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"108⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"109⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"110⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"111⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"112⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"113⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"114⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"115⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"116⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"117⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"118⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"119⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"120⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"121⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-